CVE-2026-124671

Not scored yetLast modified Nov 15, 2026

Description

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 15, 2026
Last modified
Nov 15, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-124673The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post stCVE-2026-1246797.8Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header disCVE-2026-124688.3Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentCVE-2026-1246807.0Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstrCVE-2026-1246838.7Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokCVE-2026-1246845.7A use-after-free vulnerability exists in Samsung Escargot 5.0.2 in the buffer-access paths for ReloadableString and CompressibleString. InteCVE-2026-1246865.4In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invCVE-2026-1246877.1In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection thCVE-2026-1246887.1In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spritCVE-2026-1246897.1In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, andCVE-2026-124694.3Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a craftCVE-2026-1246907.1In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can inf
CVE-2026-124671: Unscored | Vulnix