Veille CVE

Lundi 19 octobre 2026

3 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Patreon WordPress » ✕
  1. CVE-2026-92433 6.5 Moyenne

    Unknown Patreon WordPress

    The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.

  2. CVE-2026-92432 4.3 Moyenne

    Unknown Patreon WordPress

    The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.

  3. CVE-2026-92431 3.7 Faible

    Unknown Patreon WordPress

    The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.