CVE Watch7 de nov. de 2026

CVE-2026-66669

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross

CVSS

8.8

Alta

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 7 de nov. de 2026 · Última mod.: 7 de nov. de 2026 · CWE-352

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.

Referências oficiais

patchstack.comhttps://patchstack.com/database/wordpress/plugin/superb-blocks/vulnerability/wordpress-superb-addons-blocks-patterns-amp-theme-designer-plugin-4-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1217836.5 MÉD

—

———Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.5h CVE-2026-1217628.8 ALT

—

———Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.18.0.6h CVE-2026-1194846.3 MÉD

—

———Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.6h CVE-2026-1226755.4 MÉD

—

———Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.7h CVE-2026-173695.4 MÉD

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.11h CVE-2026-173125.4 MÉD

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.11h