Skip to content

Commit 3f2bb04

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-f78j-xwc8-gq3q GHSA-j3f9-r5x4-pr68 GHSA-w9qj-pq6f-hqr7 GHSA-x75g-w554-rmfv
1 parent 47defad commit 3f2bb04

4 files changed

Lines changed: 127 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/09/GHSA-f78j-xwc8-gq3q/GHSA-f78j-xwc8-gq3q.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f78j-xwc8-gq3q",
4+
"modified": "2026-09-26T09:30:19Z",
5+
"published": "2026-09-26T09:30:19Z",
6+
"aliases": [
7+
"CVE-2026-18143"
8+
],
9+
"details": "The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18143"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://woocommerce.com/products/request-a-quote-plugin-for-woocommerce"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3417ec27-6abf-45c7-945f-6ef456ba1187?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-434"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-09-26T07:17:02Z"
39+
}
40+
}

‎advisories/unreviewed/2026/09/GHSA-j3f9-r5x4-pr68/GHSA-j3f9-r5x4-pr68.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j3f9-r5x4-pr68",
4+
"modified": "2026-09-26T09:30:19Z",
5+
"published": "2026-09-26T09:30:19Z",
6+
"aliases": [
7+
"CVE-2026-11871"
8+
],
9+
"details": "The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11871"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/9ca61aee-c36a-41c5-b4e7-1626c5720362"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-09-26T07:17:00Z"
28+
}
29+
}

‎advisories/unreviewed/2026/09/GHSA-w9qj-pq6f-hqr7/GHSA-w9qj-pq6f-hqr7.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w9qj-pq6f-hqr7",
4+
"modified": "2026-09-26T09:30:19Z",
5+
"published": "2026-09-26T09:30:19Z",
6+
"aliases": [
7+
"CVE-2026-19708"
8+
],
9+
"details": "The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19708"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/a0cbfd20-7741-44d0-96c4-054a7952f81b"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-09-26T07:17:02Z"
28+
}
29+
}

‎advisories/unreviewed/2026/09/GHSA-x75g-w554-rmfv/GHSA-x75g-w554-rmfv.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x75g-w554-rmfv",
4+
"modified": "2026-09-26T09:30:19Z",
5+
"published": "2026-09-26T09:30:19Z",
6+
"aliases": [
7+
"CVE-2026-16591"
8+
],
9+
"details": "The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16591"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://wpscan.com/vulnerability/7b5600f1-1024-4329-97de-6347420e46c1"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2026-09-26T07:17:01Z"
28+
}
29+
}

0 commit comments

Comments
 (0)