CVE-2026-16502

Publié : 8 septembre 2026

Modifié : 8 septembre 2026

Score CVSS

8.8

HIGH

Description détaillée

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.10/modules/downloads/module.php#L4972 https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.10/modules/downloads/module.php#L4975 https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.10/modules/downloads/module.php#L5685 https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.16/modules/downloads/module.php#L4972 https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.16/modules/downloads/module.php#L4975 https://plugins.trac.wordpress.org/browser/live-composer-page-builder/tags/2.1.16/modules/downloads/module.php#L5685 https://plugins.trac.wordpress.org/changeset/3628023/https://www.wordfence.com/threat-intel/vulnerabilities/id/1db28477-8982-4e47-b5ed-26fd211ee925?source=cve

Dernières Vulnérabilités

CVE-2026-86644

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."

VOIR DÉTAILS

CVE-2026-79379

A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed in v.5.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted frame.

VOIR DÉTAILS

CVE-2026-79378

An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.

VOIR DÉTAILS