浏览 42+ 条来自 NVD 与 CNNVD 的 CVE 漏洞，配 AI 中文翻译、AI POC 生成、每日情报；可按厂商、产品、严重等级、CWE 检索。
| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-1883 | Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion | wickedplugins | Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types | Medium | 4.3 | 2026-03-15 01:19:06 | Deep Dive |
| CVE-2025-14997 | BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion | buddydev | BuddyPress Xprofile Custom Field Types | High | 8.8 | 2026-01-06 04:31:57 | Deep Dive |
| CVE-2025-5084 | Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text'] | mdshuvo | Post Grid Master — Post Grids & AJAX Filters | Medium | 6.1 | 2025-07-24 09:22:15 | Deep Dive |
| CVE-2025-52726 | WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerability | pebas | CouponXxL Custom Post Types | High | 8.6 | 2025-06-27 11:52:26 | Deep Dive |
| CVE-2024-10143 | MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS | Unknown | MB Custom Post Types & Custom Taxonomies | - | - | 2025-05-15 20:06:41 | Deep Dive |
| CVE-2025-31809 | WordPress Labinator Content Types Duplicator Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability | Labinator | Labinator Content Types Duplicator | Medium | 4.3 | 2025-04-01 14:51:39 | Deep Dive |
| CVE-2025-22748 | WordPress SetMore Theme – Custom Post Types plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerability | Setmore | SetMore Theme – Custom Post Types | Medium | 6.5 | 2025-01-15 15:23:30 | Deep Dive |
| CVE-2024-11642 | Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion | mdshuvo | Post Grid Master — Post Grids & AJAX Filters | Critical | 9.8 | 2025-01-09 11:11:04 | Deep Dive |
| CVE-2024-10016 | File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload | jaredatch | File Upload Types by WPForms | Medium | 6.4 | 2024-10-25 08:34:40 | Deep Dive |
| CVE-2024-10078 | WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions | chertz | WP Easy Post Types | Medium | 6.3 | 2024-10-18 07:35:27 | Deep Dive |
| CVE-2024-10079 | WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection | chertz | WP Easy Post Types | High | 8.8 | 2024-10-18 07:35:26 | Deep Dive |
| CVE-2024-10080 | WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta | chertz | WP Easy Post Types | Medium | 6.4 | 2024-10-18 07:35:25 | Deep Dive |
| CVE-2022-4974 | Freemius SDK <= 2.4.2 - Missing Authorization Checks | dashlabsltd | YASR – Yet Another Star Rating Plugin for WordPress | Medium | 6.3 | 2024-10-16 06:43:30 | Deep Dive |
| CVE-2024-4759 | Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload | Unknown | Mime Types Extended | - | - | 2024-06-25 06:00:03 | Deep Dive |
| CVE-2024-3956 | Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL | sc0ttkclark | Pods – Custom Content Types and Fields | Medium | 5.4 | 2024-05-10 08:32:34 | Deep Dive |
| CVE-2024-32108 | WordPress Convert Post Types plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability | Stephanie Leary | Convert Post Types | Medium | 4.3 | 2024-04-11 12:56:26 | Deep Dive |
| CVE-2023-6999 | Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution | sc0ttkclark | Pods – Custom Content Types and Fields | High | 8.8 | 2024-04-09 18:59:26 | Deep Dive |
| CVE-2023-6965 | Pods - Custom Content Types and Fields - Missing Authorization | sc0ttkclark | Pods – Custom Content Types and Fields | Medium | 4.3 | 2024-04-09 18:59:21 | Deep Dive |
| CVE-2023-6993 | Custom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | totalpressorg | Custom post types, Custom Fields & more | Medium | 6.4 | 2024-04-09 18:58:40 | Deep Dive |
| CVE-2023-6967 | Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode | sc0ttkclark | Pods – Custom Content Types and Fields | High | 8.8 | 2024-04-09 18:58:35 | Deep Dive |