Logo
Retour à la veille

CVE-2026-109191

Publié : 16 octobre 2026
Modifié : 16 octobre 2026
Lien officiel NVD
Score CVSS
4.3
MEDIUM

Description détaillée

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/image-hub.php#L46https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L19https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L38https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L56https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L23https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L78https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Utils.php#L11https://plugins.trac.wordpress.org/changeset/3745452/image-hub/trunk/inc/src/MediaModal.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/99d1e0cc-1fd0-47f7-8b73-33663ed72eea?source=cve

Dernières Vulnérabilités

CVE-2026-97640

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request.

VOIR DÉTAILS

CVE-2026-97296

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.

VOIR DÉTAILS

CVE-2026-96339

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.

VOIR DÉTAILS