Logo
Retour à la veille

CVE-2026-10511

Publié : 27 octobre 2026
Modifié : 27 octobre 2026
Lien officiel NVD
Score CVSS
6.4
MEDIUM

Description détaillée

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.15.0/includes/extensions/raven/includes/modules/forms/widgets/login.php#L401https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.15.0/includes/extensions/raven/includes/modules/forms/widgets/login.php#L648https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.15.0/includes/extensions/raven/includes/modules/forms/widgets/login.php#L736https://plugins.trac.wordpress.org/changeset/3759312/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/widgets/login.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/7736342c-21e8-42e6-8af8-31c69ff7781e?source=cve

Dernières Vulnérabilités

CVE-2026-90732

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

VOIR DÉTAILS

CVE-2026-90731

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

VOIR DÉTAILS

CVE-2026-90730

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

VOIR DÉTAILS