Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
AskAny - Security Vulnerability (CVE-2026-121498)
The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details.
PLUGIN
AskAny
CVE-2026-121498
Risk Score
Threat Entry
Updated 2026-11-12
AskAny - Security Vulnerability (CVE-2026-121497)
The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.
PLUGIN
AskAny
CVE-2026-121497
Risk Score