Demander un audit

Retour à la veille

CVE-2026-95817

Publié : 2 octobre 2026

Modifié : 2 octobre 2026

Lien officiel NVD

Score CVSS

7.2

HIGH

Description détaillée

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/dofollow-case-by-case/tags/3.6.0/dofollow-case-by-case.php#L733 https://plugins.trac.wordpress.org/browser/dofollow-case-by-case/tags/3.6.0/dofollow-case-by-case.php#L748 https://plugins.trac.wordpress.org/browser/dofollow-case-by-case/tags/3.6.0/dofollow-case-by-case.php#L797 https://plugins.trac.wordpress.org/changeset?reponame=&old=3721278%40dofollow-case-by-case&new=3721278%40dofollow-case-by-case https://www.wordfence.com/threat-intel/vulnerabilities/id/2e426151-a8cb-48b9-9fa4-170fc3371629?source=cve

Dernières Vulnérabilités

CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96292

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96288

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.