Veille CVE

Recherche « Unknown Solace Extra »

4 CVE

Critique 0 Élevée 1 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Solace Extra » ✕
  1. CVE-2026-80333 5.3 Moyenne

    Unknown Solace Extra

    The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.

  2. CVE-2026-16966 5.3 Moyenne

    Unknown Solace Extra

    The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder parts that WordPress would otherwise not serve.

  3. CVE-2026-16965 4.3 Moyenne

    Unknown Solace Extra

    The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.

  4. CVE-2026-16948 8.1 Élevée

    Unknown Solace Extra

    The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.