WordPress Plugin Contextual Related Posts 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

PT-2026-26041

Name of the Vulnerable Software and Affected Versions WebberZone Contextual Related Posts versions prior to 4.2.2 Description An authorization issue exists in WebberZone Contextual Related Posts due to incorrectly configured access control security levels. This allows for unauthorized access...

CVE-2026-25770

creationtimestamp| type| source ---|---|--- 2026-03-17 21:02:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbunjfvy62k 2026-03-17 21:02:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbuocmang26 2026-03-19 18:20:09+00:00| seen|...

CVE-2026-33166

creationtimestamp| type| source ---|---|--- 2026-03-17 19:33:39+00:00| published-proof-of-concept| https://github.com/allure-framework/allure2/security/advisories/GHSA-64hm-gfwq-jppw 2026-03-20 22:17:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjkayru3c2f 2026-03-20...

CVE-2026-3888

creationtimestamp| type| source ---|---|--- 2026-03-17 19:24:31+00:00| seen| https://t.me/ctinow/247297 2026-03-17 20:01:23+00:00| seen| https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mhbrae5mtr62 2026-03-17 20:33:25+00:00| seen|...

CVE-2026-32295

creationtimestamp| type| source ---|---|--- 2026-03-17 19:00:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnsu3ucx2f 2026-03-17 19:01:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnuzm64r2c 2026-03-18 17:04:14+00:00| seen|...

CVE-2026-32292

creationtimestamp| type| source ---|---|--- 2026-03-17 18:59:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnqtshit2c 2026-03-17 18:59:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnrugfpz2c 2026-03-18 07:30:29+00:00| seen|...

CVE-2026-32298

creationtimestamp| type| source ---|---|--- 2026-03-17 18:58:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnqr745s2u 2026-03-17 18:59:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnrnn7yv25 2026-03-17 19:00:01+00:00| seen|...

CVE-2026-32297

creationtimestamp| type| source ---|---|--- 2026-03-17 18:58:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnqkje7s2k 2026-03-17 18:59:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbnrh2ehj2c 2026-03-17 18:59:54+00:00| seen|...

EUVD-2026-12537

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the getmainqueryargs function due to insufficient restrictions on which posts can be included. This makes it possib...

CVE-2026-2373 Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the getmainqueryargs function due to insufficient restrictions on which posts can be included. This makes it possib...

PT-2026-25941

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0 Fortinet FortiOS affected versions not specified Description CI4MS, a CodeIgniter 4-based CMS skeleton, is susceptible to stored cross-site scripting XSS due to improper sanitization of user-controlled input wh...

CVE-2026-33039

creationtimestamp| type| source ---|---|--- 2026-03-16 15:30:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw 2026-03-20 23:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjmoerimy26 2026-03-20 23:01:48+00:0...

Mattermost fails to properly enforce read permissions in search API endpoints

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554...

GHSA-CWFJ-642J-GFH4 Mattermost fails to properly enforce read permissions in search API endpoints

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554...

EUVD-2026-12443

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554...

EUVD-2026-12415

Mattermost versions 11.3.x = 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579...

CVE-2026-24692

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554...

CVE-2026-24692 Guest users can bypass read permissions via search API

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554...

CVE-2026-2578

Mattermost versions 11.3.x = 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579...