CVE-2026-1085

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The True Ranker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.9. This is due to missing nonce validation on the seolocalrank-signout action. This makes it possible for unauthenticated attackers to disconnect the administrator's True Ranker account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
optimizza	True Ranker	<= 2.2.9

References

Timeline

Published: Mar 7, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-108505.4Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work CVE-2026-1085006.5Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to creat CVE-2026-1085015.7ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information CVE-2026-1085023.3ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hook CVE-2026-1085033.3ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access con CVE-2026-1085045.5ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient.CVE-2026-1085053.3ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to o CVE-2026-1085065.5ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call th CVE-2026-1085146.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site S CVE-2026-1085156.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site S CVE-2026-1085182.9DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an CVE-2026-108527.5IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer