News & Sicurezza

CVE ID :CVE-2026-1993 Published : March 11, 2026, 10:16 a.m. | 4 hours, 8 minutes ago Description :The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3231 Published : March 11, 2026, 10:16 a.m. | 4 hours, 8 minutes ago Description :The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Fixes 79 Flaws in March Patch Tuesday, Including Two 0-Days Microsoft has released its March 2026 Patch Tuesday security updates, addressing dozens of vulnerabilities across Windows, enterprise platforms, and developer frameworks. The monthly update resolves 7 ... Read more Published Date: Mar 11, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-26127 CVE-2026-21262 CVE-2026-21536

CVE ID :CVE-2026-3906 Published : March 11, 2026, 10:16 a.m. | 4 hours, 8 minutes ago Description :WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3492 Published : March 11, 2026, 10:16 a.m. | 4 hours, 8 minutes ago Description :The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (`sanitize_text_field()` preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (`title` attribute constructed without `esc_attr()`, and JavaScript `saferHtml` utility only escapes `&`, `` but not quotes). This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary JavaScript that executes when an Administrator searches in the Form Switcher dropdown in the Form Editor. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Zero-click XSS-lek in Microsoft Excel maakt datadiefstal via Copilot mogelijk Tijdens de patchdinsdag van maart heeft Microsoft updates uitgebracht voor een kritieke kwetsbaarheid in Excel, waardoor een aanvaller informatie van gebruikers via Copilot kan stelen, waarbij een geb ... Read more Published Date: Mar 11, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-26144 CVE-2026-26113 CVE-2026-26110

The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard.

CVE ID :CVE-2026-1454 Published : March 11, 2026, 9:16 a.m. | 5 hours, 8 minutes ago Description :The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days Microsoft on Tuesday released patches for a set of 84 new security vulnerabilities affecting various software components, including two that have been listed as publicly known. Of these, eight are rat ... Read more Published Date: Mar 11, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-26144 CVE-2026-26127 CVE-2026-26118 CVE-2026-25187 CVE-2026-21262 CVE-2026-21536 CVE-2026-21385 CVE-2026-21513

Microsoft Patch Tuesday March 2026: Two Zero-Days and Critical RCE Bugs Fixed The Microsoft Patch Tuesday March 2026 release introduces security updates addressing 79 vulnerabilities, including two publicly disclosed zero-day vulnerabilities and several high-risk issues tied to ... Read more Published Date: Mar 11, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-26144 CVE-2026-26128 CVE-2026-26127 CVE-2026-26118 CVE-2026-26114 CVE-2026-26113 CVE-2026-26110 CVE-2026-26109 CVE-2026-26106 CVE-2026-21262 CVE-2026-27944 CVE-2026-22778 CVE-2024-53961

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class failing to prevent the `append_where_sql` parameter from being passed through JSON request bodies, while only checking for its presence in the `$_REQUEST` superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the `append_where_sql` parameter in JSON payloads granted they have obtained a valid `public_token` that is inadvertently exposed during the booking flow.

CVE ID :CVE-2026-1708 Published : March 11, 2026, 8:16 a.m. | 6 hours, 8 minutes ago Description :The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class failing to prevent the `append_where_sql` parameter from being passed through JSON request bodies, while only checking for its presence in the `$_REQUEST` superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the `append_where_sql` parameter in JSON payloads granted they have obtained a valid `public_token` that is inadvertently exposed during the booking flow. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...