GCVE - cpe:2.3:a:shen2:多说社会化评论框:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:shen2:多说社会化评论框:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Shen2 (`f43f49b6-0507-5727-99ac-0efae8dea6dc`)
Product	多说社会化评论框 (`d07756cf-1900-5bbc-a31a-eafe3166eb99`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-14482`	vulnerable	2026-07-29 00:26:17.054805	多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters HIGH (8.8) The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator` and enabling open registration — and subsequently register an account with full administrator privileges. Published: 2026-07-08T04:30:50.223Z Updated: 2026-07-08T13:57:46.333Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/732c7ccd-de50-4e27-8cb9-3bb0ed30f0b4?source=cve https://plugins.trac.wordpress.org/browser/duoshuo/tags/1.2/LocalServer.php#L49 https://plugins.trac.wordpress.org/browser/duoshuo/tags/1.2/LocalServer.php#L54 https://plugins.trac.wordpress.org/browser/duoshuo/tags/1.2/api.php#L40	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-49056`	vulnerable	2026-06-08 07:29:12.522928	WordPress 多说社会化评论框 Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability HIGH (7.1) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shen2 多说社会化评论框 duoshuo allows Reflected XSS.This issue affects 多说社会化评论框: from n/a through <= 1.2. Published: 2025-08-14T10:34:15.436Z Updated: 2026-04-28T16:12:58.268Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-48318`	vulnerable	2026-06-08 07:27:15.694835	WordPress 多说社会化评论框 plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability MEDIUM (4.3) Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1.2. Published: 2025-08-28T12:36:55.685Z Updated: 2026-04-28T16:12:56.127Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.