Skip to content

Commit d0b0253

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent f7a9c8f commit d0b0253

29 files changed

Lines changed: 1079 additions & 3 deletions

File tree

‎advisories/unreviewed/2026/06/GHSA-2pxw-w9w5-c6hm/GHSA-2pxw-w9w5-c6hm.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2pxw-w9w5-c6hm",
4+
"modified": "2026-06-16T12:32:02Z",
5+
"published": "2026-06-16T12:32:02Z",
6+
"aliases": [
7+
"CVE-2026-8176"
8+
],
9+
"details": "The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8176"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php#L415"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php#L491"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customers_controller.php#L342"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php#L253"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/models/customer_model.php#L322"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php#L415"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php#L491"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customers_controller.php#L342"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/orders_controller.php#L100"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/orders_controller.php#L124"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/helpers/customer_helper.php#L253"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/models/customer_model.php#L322"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php#L415"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php#L491"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customers_controller.php#L342"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/orders_controller.php#L100"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/orders_controller.php#L124"
89+
},
90+
{
91+
"type": "WEB",
92+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/customer_helper.php#L253"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/models/customer_model.php#L322"
97+
},
98+
{
99+
"type": "WEB",
100+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/models/customer_model.php#L427"
101+
},
102+
{
103+
"type": "WEB",
104+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3531832%40latepoint&old=3522933%40latepoint&sfp_email=&sfph_mail="
105+
},
106+
{
107+
"type": "WEB",
108+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5bb6c-2021-4fc0-bede-8da1c3fb591a?source=cve"
109+
}
110+
],
111+
"database_specific": {
112+
"cwe_ids": [
113+
"CWE-269"
114+
],
115+
"severity": "HIGH",
116+
"github_reviewed": false,
117+
"github_reviewed_at": null,
118+
"nvd_published_at": "2026-06-16T10:16:28Z"
119+
}
120+
}

‎advisories/unreviewed/2026/06/GHSA-2x8h-2m6p-f79p/GHSA-2x8h-2m6p-f79p.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2x8h-2m6p-f79p",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2026-54190"
8+
],
9+
"details": "Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54190"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/envira-gallery-lite/vulnerability/wordpress-envira-photo-gallery-plugin-1-12-5-broken-access-control-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:28Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-496r-7vwg-mwcf/GHSA-496r-7vwg-mwcf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-496r-7vwg-mwcf",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2026-54198"
8+
],
9+
"details": "Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54198"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-35-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:28Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-57gx-7458-mhwq/GHSA-57gx-7458-mhwq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57gx-7458-mhwq",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2026-40809"
8+
],
9+
"details": "Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Metro Magazine: from n/a through 1.4.1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40809"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/theme/metro-magazine/vulnerability/wordpress-metro-magazine-theme-1-4-1-broken-access-control-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:27Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-642g-j4h8-6jrc/GHSA-642g-j4h8-6jrc.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-642g-j4h8-6jrc",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2025-68045"
8+
],
9+
"details": "Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68045"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-12-broken-access-control-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:25Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-6g34-fq4g-j6p6/GHSA-6g34-fq4g-j6p6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6g34-fq4g-j6p6",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2026-52711"
8+
],
9+
"details": "Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52711"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce-pos/vulnerability/wordpress-woocommerce-pos-plugin-1-8-14-broken-access-control-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:27Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-6h64-2vq4-m659/GHSA-6h64-2vq4-m659.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6h64-2vq4-m659",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2026-39574"
8+
],
9+
"details": "Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39574"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/inpost-gallery/vulnerability/wordpress-inpost-gallery-plugin-2-1-4-6-sql-injection-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:27Z"
35+
}
36+
}

‎advisories/unreviewed/2026/06/GHSA-8ph6-g5r7-mqc9/GHSA-8ph6-g5r7-mqc9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8ph6-g5r7-mqc9",
4+
"modified": "2026-06-16T12:32:01Z",
5+
"published": "2026-06-16T12:32:01Z",
6+
"aliases": [
7+
"CVE-2026-52715"
8+
],
9+
"details": "Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52715"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-sql-injection-vulnerability?_s_id=cve"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-06-16T10:16:28Z"
35+
}
36+
}

0 commit comments

Comments
 (0)