CyberSec.Space Logo
Back to CVE Browser

CVE-2026-15244

N/A
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2026-08-01
Last Modified2026-08-01
Data SourcesNVD

Vulnerability Description

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://wpscan.com/vulnerability/7384ebb7-a581-45c7-ab48-0fdf30a1569d/

Related Vulnerabilities

CVE-2026-64536.5

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due t...

CVE-2026-184356.4

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting v...

CVE-2026-183446.1

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in ...

CVE-2026-180626.4

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting v...