[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sun Oct 11 08:13:36 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
cb1d4160 by security tracker role at 2026-10-11T07:13:26+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,339 +1,339 @@
CVE-2026-97853 (Memory Allocation with Excessive Size Value vulnerability in ericmj de ...)
TODO: check
CVE-2026-97183 (The WP-Invoice WordPress plugin through 4.3.1 does not perform capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96227 (The Piotnet Forms WordPress plugin through 1.0.30 does not authenticat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94235 (The MemberHero WordPress plugin through 6.9 does not perform any capa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93550 (The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91829 (The Subscribe to Comments WordPress plugin before 2.3.3 does not prope ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89305 (The paymendo WordPress plugin through 1.1 does not properly sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89304 (The paymendo WordPress plugin through 1.1 does not properly sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89302 (The Post Voting System WordPress plugin through 1.0 does not properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89299 (The WP Verify API WordPress plugin through 1.0.0 does not properly san ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89297 (The Loja Autom\xe1tica WordPress plugin through 1.0.0 does not properl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89287 (The ASPL Product Quotation WordPress plugin through 1.1.0 does not san ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89285 (The Datalist it WordPress plugin through 0.0.3 does not sanitize and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89283 (The WP Posts Password Batch Manager WordPress plugin through 1.1 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89234 (The WP-Partner WordPress plugin through 1.2.1 does not sanitise and es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89232 (The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89214 (The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89213 (The Llavero.io WordPress plugin through 0.1.4 does not properly saniti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89195 (The Site Setup Wizard WordPress plugin through 1.5.8 does not properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88930 (The Social Web Suite WordPress plugin through 4.1.12 does not require ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88905 (The KeyWord Collector WordPress plugin through 1.4 does not have any a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88903 (The Topcontent WordPress plugin through 1.2.1 does not properly author ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88827 (The Disable Users WordPress plugin through 1.0.5 does not enforce its ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88826 (The SmugMug Embed WordPress plugin through 3.13 does not have authoris ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88785 (The Simple Membership WordPress plugin before 4.8.3 does not avoid tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87764 (The BuddyPress Instant Chat WordPress plugin through 1.6 does not chec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87762 (The Adwised Web Push Notification WordPress plugin through 2.5.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87761 (The Adwised Web Push Notification WordPress plugin through 2.5.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87760 (The Web Vitals Tracking WordPress plugin through 5.4.2 does not valida ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86798 (The HootBoard WordPress plugin through 3.1.4 does not perform any aut ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86717 (The Insurify WordPress plugin through 1.0 does not have authorisation ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86706 (The Quick quotes WordPress plugin through 1.0.0 does not perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85126 (The Crowdfundly WordPress plugin through 2.2.2 does not have capabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85121 (The Insurify WordPress plugin through 1.0 does not have authorisation ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85118 (The AI Content Generator Marketing WordPress plugin through 1.0.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84737 (The Freeton WP WordPress plugin through 1.0.0 does not correctly valid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84734 (The Mindstien Quick Login WordPress plugin through 1.0 does not correc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84261 (The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84260 (The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84259 (The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84258 (The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84254 (The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84253 (The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84252 (The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84251 (The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81797 (Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81649 (The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not ha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81420 (The Tcard WP WordPress plugin through 1.8.0 does not sanitise and esca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81156 (The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81155 (The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81154 (The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81153 (The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78535 (Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78534 (Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78533 (Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78532 (Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78531 (Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78530 (Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-78529 (Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66569 (Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66568 (Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66567 (Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66566 (Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66565 (Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66564 (Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66563 (Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66483 (Unauthenticated PHP Object Injection in Education Center <= 3.6.12 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66482 (Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66481 (Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66480 (Exposure of Sensitive System Information to an Unauthorized Control Sp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-65459 (Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62130 (Shop manager PHP Object Injection in WooCommerce Multilingual & Multic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62129 (Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62125 (Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62124 (Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62123 (Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62120 (Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62118 (Unauthenticated Broken Access Control in Barcode Scanner with Inventor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62117 (Subscriber SQL Injection in Barcode Scanner with Inventory & Order Man ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62116 (Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62115 (Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62100 (Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62099 (Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62098 (Unauthenticated Content Injection in Boutique <= 2.3.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62096 (Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62095 (Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62094 (Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62093 (Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62092 (Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62091 (Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62090 (Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62087 (Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62086 (Unauthenticated PHP Object Injection in Juno <= 2.25 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62082 (Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62077 (Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62076 (Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62075 (Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62074 (Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62070 (Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62069 (Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62068 (Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62067 (Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62066 (Unauthenticated Local File Inclusion in Volos <= 1.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62065 (Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62064 (Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62054 (Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62053 (Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62052 (Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62051 (Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62050 (Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62043 (Unauthenticated Sensitive Data Exposure in Contact Form 7 \u2013 Dynam ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62038 (Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62037 (Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62035 (Subscriber Broken Access Control in AWS S3 for WordPress Plugin \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62034 (Unauthenticated Cross Site Scripting (XSS) in Before After Image Compa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62033 (Subscriber Settings Change in uListing <= 2.2.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62032 (Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62031 (Unauthenticated SQL Injection in uListing <= 2.2.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62030 (Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62027 (Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62025 (Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62024 (Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62022 (Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62021 (Subscriber PHP Object Injection in Angio <= 1.1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62020 (Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-57742 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48194 (Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48193 (Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-45440 (Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42777 (Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42724 (Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42723 (Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42722 (Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42719 (Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42718 (Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42717 (Administrator SQL Injection in Leyka <= 3.32.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42716 (Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42715 (Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42712 (Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42711 (Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42709 (Unauthenticated Cross Site Scripting (XSS) in Food Menu \u2013 Restaur ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42706 (Unauthenticated Broken Access Control in DK <= 3.2.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42705 (Unauthenticated Broken Access Control in Grand News <= 3.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42704 (Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42702 (Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <= 4.1.0 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42699 (Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42697 (Unauthenticated Cross Site Scripting (XSS) in Social Share Icons & Soc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42696 (Unauthenticated Remote Code Execution (RCE) in SiteVault \u2013 Backup ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42693 (Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42633 (Subscriber SQL Injection in Events Manager <= 7.4.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42632 (Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42631 (Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42630 (Unauthenticated Sensitive Data Exposure in Web Plura Backup & Rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42419 (Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40808 (Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40805 (Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40803 (Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatb ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40802 (Subscriber Settings Change in Pubjet | \u067e\u0627\u0628\u062c\u062a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40801 (Subscriber Broken Access Control in Wordable <= 8.2.10 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40800 (Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Produc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40777 (Subscriber Broken Access Control in WPSection <= 1.5.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39802 (Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39801 (Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39800 (Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39799 (Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27350 (Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Buil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-14854 (The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-12980 (The Post Snippets WordPress plugin through 4.2.4 does not properly es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108708 (Wukong_HRM through commit 186115e contains a missing authorization vul ...)
TODO: check
CVE-2026-108707 (Wukong_HRM through commit 186115e contains an authentication bypass vu ...)
@@ -543,35 +543,35 @@ CVE-2026-108522 (A vulnerability was found in Studio-Saelix Sencho up to 0.94.1.
CVE-2026-108521 (A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. A ...)
TODO: check
CVE-2026-107694 (The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107507 (The Squadeno WordPress plugin before 1.12.0 does not enforce its rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107434 (Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107420 (Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooComme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106029 (The WeddingCity Lite WordPress plugin through 1.0.4 does not perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104841
REJECTED
CVE-2026-104684 (The Envira Gallery WordPress plugin before 1.16.2 does not verify tha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104682 (The Envira Gallery WordPress plugin before 1.16.2 does not correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104681 (The Envira Gallery WordPress plugin before 1.16.2 does not verify tha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104680 (The Envira Gallery WordPress plugin before 1.16.2 does not verify tha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104028 (The Anton Extensions WordPress plugin through 1.2.2 does not perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103695 (The Mobile builder WordPress plugin through 1.4.2 does not sanitise an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103694 (The Mobile builder WordPress plugin through 1.4.2 does not properly re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103685 (Missing Authorization vulnerability in VillaTheme ALD \u2013 Dropshipp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103305 (The Prenotazioni WordPress plugin through 1.7.5 does not have authoris ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97396 (The Email Marketing for WordPress and WooCommerce \u2013 Retainful plu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97340 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
@@ -760,13 +760,13 @@ CVE-2026-104722 (The Listdom: AI-powered Business Directory with Classifieds Ads
CVE-2026-104398 (Deserialization of Untrusted Data vulnerability in VillaTheme AFFI \u2 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103636 (Out-of-bounds read in the VarOpt union deserialization of Apache DataS ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103635 (Out-of-bounds read in the compact Theta sketch deserialization of Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103513 (Out-of-bounds read and write in the CPC sketch deserialization of Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103501 (Heap buffer overflow in the HLL sketch deserialization of Apache DataS ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103478 (The Premium Packages \u2013 Sell Digital Products Securely plugin for ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103357 (Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-c ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb1d416039eb734469db1136cd4b7e05ed198a9c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb1d416039eb734469db1136cd4b7e05ed198a9c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261011/1afc6456/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list