插件名稱	句子到SEO（關鍵字、描述和標籤）
漏洞類型	跨站腳本攻擊 (XSS)
CVE 編號	CVE-2026-4142
緊急程度	低
CVE 發布日期	2026-04-22
來源 URL	CVE-2026-4142

句子到SEO中的經過身份驗證的管理員存儲XSS（≤ 1.0）— WordPress網站擁有者現在必須做什麼

作者： 香港安全專家

日期： 2026-04-21

摘要：在WordPress插件“Sentence To SEO (keywords, description and tags)”中報告了一個存儲型跨站腳本（XSS）漏洞（CVE‑2026‑4142）——影響版本≤ 1.0。該缺陷允許經過身份驗證的管理員注入HTML/JavaScript，這些內容會被存儲並在後續執行。雖然CVSS相對較低（4.4），但在管理員上下文中的存儲型XSS如果管理員帳戶被攻擊或濫用，可能成為攻擊者的一個強大跳板。這篇文章解釋了風險、檢測、遏制和您現在應該採取的實際緩解步驟。.

發生了什麼（簡短）

安全研究人員披露了WordPress的句子到SEO（關鍵字、描述和標籤）插件中的一個存儲跨站腳本（XSS）漏洞，追蹤為CVE-2026-4142。該問題存在於版本1.0及以下。它允許具有管理員權限的經過身份驗證的用戶將精心製作的內容（HTML/JS）保存到插件管理的字段中。該內容後來在沒有適當轉義的情況下呈現，導致腳本在查看受影響的管理或前端頁面的用戶上下文中執行。.

漏洞的技術摘要

漏洞類型：存儲跨站腳本（Stored-XSS）。.
受影響的軟件：句子到SEO（關鍵字、描述和標籤）WordPress插件。.
易受攻擊的版本：≤ 1.0。.
所需權限：管理員（已驗證）。.
CVE：CVE-2026-4142。.
影響：在管理或可能的公共上下文中執行腳本，這可能用於升級攻擊（會話盜竊、CSRF、管理操作、後門安裝），具體取決於有效載荷執行的位置。.
根本原因：插件接受管理員對元數據、關鍵字或標籤的輸入，並在後續輸出時未進行適當的清理/轉義（缺少wp_kses、esc_html/esc_attr等）。.

注意：該漏洞需要身份驗證（需要管理員用戶）並且是持久的（有效載荷持久存在於數據庫中）。雖然最初的風險向量僅限於已擁有管理員權限的人，但現實世界中的攻擊經常涉及在通過釣魚、被盜密碼或內部控制不善獲得管理員憑證後的橫向移動。.

為什麼“低”嚴重性並不意味著“忽略”

CVSS 4.4（或類似）評級反映了對影響和可利用性的有限看法。對於 WordPress 網站：

管理員帳戶是主要目標——一旦攻擊者控制了管理員帳戶，他們可以安裝後門、創建新的管理員用戶或導出數據。.
管理員 UI 中的身份驗證存儲 XSS 可以轉化為完全的網站妥協（竊取憑證、通過受害者管理員的瀏覽器執行操作、安裝惡意插件）。.
許多妥協始於憑證重用或社會工程；需要管理員權限的漏洞降低了在獲得憑證後升級攻擊的門檻。.

需要謹慎的回應：及時修補或虛擬修補並審計之前的利用情況。.

誰受到影響和攻擊向量

受影響方：任何運行 Sentence To SEO 插件版本 1.0 或以下的 WordPress 網站。.
攻擊前提：攻擊者需要一個管理員帳戶，或能夠讓管理員訪問一個由攻擊者控制的鏈接，該鏈接在管理員上下文中觸發存儲的 XSS。.
典型攻擊向量：
- 惡意管理員（內部威脅）將腳本添加到插件設置或元數據中。.
- 被妥協的管理員帳戶（憑證重用/釣魚）用於注入有效載荷。.
- 當管理員或其他用戶查看受影響的屏幕（管理員設置頁面、帖子編輯器、分類頁面或前端輸出）時，存儲的 XSS 有效載荷會執行。.

攻擊者如何濫用管理員存儲XSS

管理員界面中的存儲 XSS 是強大的，因為管理員的瀏覽器上下文通常包括提升的權限和活動會話。濫用的例子：

竊取管理員的 Cookie 或會話令牌，使攻擊者能夠冒充管理員。.
使用管理員的瀏覽器執行操作（創建新的管理員用戶，安裝惡意插件/主題，更改DNS/設置）。.
竊取可通過管理員屏幕訪問的配置數據、API 密鑰或數據庫內容。.
傳遞第二階段有效載荷，這些有效載荷聯繫攻擊者的 C2 伺服器，使清理和檢測變得更加困難。.

由於易受攻擊的字段是持久的，惡意代碼可以在重啟後存活並持續存在於備份和導出中——增加了修復的複雜性。.

立即緩解步驟（快速檢查清單）

如果您運行 WordPress 並安裝了此插件，請立即執行以下操作：

確認插件版本：
- WP 管理員 → 插件 → 找到“Sentence To SEO”並注意版本。.
如果您正在運行 ≤ 1.0：
- 如果您能承受其功能暫時失效，請立即停用該插件。.
- 如果您無法停用，請限制對管理界面的訪問（見下文）。.
旋轉所有管理員密碼，並確保使用唯一密碼/密碼管理器。.
為所有管理員帳戶啟用 MFA。.
在網絡/應用層（WAF 或等效）應用輸入過濾器，以阻止針對插件端點的明顯腳本有效負載。.
搜尋可疑的腳本標籤或數據庫和插件選項條目中的條目（以下命令）。.</li> <li>使用可信的惡意軟件掃描器掃描網站並檢查文件完整性。.</li> <li>如果您懷疑被攻擊，請遵循下面的事件響應手冊（隔離和恢復）。.</li> </ol> <p>如果發布了官方供應商補丁，請立即更新。如果沒有可用的補丁，請繼續使用虛擬補丁並減少管理員的暴露，直到供應商修復準備就緒。.</p> </section> <section id="remediation-plan"> <h2 id="detailed-remediation-and-recovery-plan">詳細的修復和恢復計劃</h2> <ol> <li><strong>清單和版本控制</strong> <ul> <li>列出所有 WordPress 網站，檢查插件是否已安裝及其版本： <pre><code>wp 插件列表 --狀態=啟用 --格式=表格</code></pre> </li> <li>如果插件存在且版本 ≤ 1.0，請考慮立即停用。.</li> </ul> </li> <li><strong>備份（進行安全副本）</strong> <ul> <li>在任何修復之前進行完整備份（數據庫 + 文件）並離線存儲，以保留取證證據。.</li> <li>注意：備份可能已經包含惡意有效負載 — 請小心處理。.</li> </ul> </li> <li><strong>隔離</strong> <ul> <li>暫時禁用該插件。.</li> <li>如果禁用會破壞網站功能，請通過 IP 限制 /wp-admin 訪問或在工作時啟用 HTTP 基本身份驗證。.</li> <li>在網絡層應用虛擬補丁規則，以阻止包含可疑腳本片段的 POST/PUT 提交針對插件的端點。.</li> </ul> </li> <li><strong>憑證和帳戶</strong> <ul> <li>強制所有管理員重設密碼。.</li> <li>刪除未知的管理員帳戶。.</li> <li>強制使用強密碼並為所有管理員啟用雙因素身份驗證。.</li> </ul> </li> <li><strong>清理數據庫</strong> <ul> <li>搜尋並移除注入到選項、文章元資料、術語元資料、使用者元資料或插件特定表格中的儲存腳本標籤：</li> <li>示例 SQL（小心使用）： <pre><code>選擇 option_id, option_name 從 wp_options WHERE option_value LIKE '%<script%'; SELECT post_id, meta_key FROM wp_postmeta WHERE meta_value LIKE '%<script%';</code></pre> </li> <li>Remove known payloads: use wp-cli search-replace with careful regular expressions or export → sanitize → reimport.</li> <li>Prefer targeted cleanup (wp-cli, controlled search/replace) over blind DELETEs.</li> </ul> </li> <li><strong>Scan files & plugins</strong> <ul> <li>Scan the wp-content folder and core files for unknown or modified PHP files.</li> <li>Compare file hashes to a clean WordPress core to detect new/changed files.</li> </ul> </li> <li><strong>Restore or cleanup</strong> <ul> <li>If cleanup is possible and you’re confident, remove the malicious injected code and re-enable the plugin once patched or safe.</li> <li>If the site is heavily compromised, consider restoring from a clean backup created before the compromise date.</li> </ul> </li> <li><strong>Patch and update</strong> <ul> <li>When the plugin author releases a patch, update to the fixed version promptly.</li> <li>Re-scan after patch to ensure no persistence remains.</li> </ul> </li> <li><strong>Follow up</strong> <ul> <li>Audit logs to see how and when the injection occurred.</li> <li>Create a timeline of events and document remediation steps.</li> </ul> </li> </ol> </section> <section id="detect-exploitation"> <h2 id="how-to-detect-past-exploitation-and-find-malicious-payloads">How to detect past exploitation and find malicious payloads</h2> <p>Stored XSS payloads are often simple script tags, event handlers, or encoded HTML. Detection steps:</p> <ul> <li><strong>Database searches</strong> <ul> <li>Search for <code><script</code>, <code>onerror=</code>, <code>onload=</code>, <code>javascript:</code>, <code><iframe</code>, <code>src="data:text/html,</code> in these tables: <ul> <li>wp_options, wp_postmeta, wp_posts (post_content), wp_terms and termmeta, wp_usermeta.</li> </ul> </li> </ul> </li> <li><strong>WP‑CLI useful commands</strong> <ul> <li><code>wp search-replace '<script' '' --skip-columns=guid --dry-run</code></li> <li><code>wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%';"</code></li> </ul> </li> <li><strong>File system scan</strong> <ul> <li>Grep for suspicious PHP functions: <code>base64_decode</code>, <code>gzinflate</code>, <code>eval</code> patterns: <pre><code>grep -R --exclude-dir=wp-includes --exclude-dir=wp-admin -n "base64_decode" .</code></pre> </li> </ul> </li> <li><strong>Webserver access logs and admin action logs</strong> <ul> <li>Look for POST requests to plugin endpoints or options.php edit actions around suspicious timestamps.</li> </ul> </li> <li><strong>Browser console traces and admin page review</strong> <ul> <li>Log into admin and inspect pages related to the plugin settings. If any content changes unexpectedly or you see unusual UI elements, investigate.</li> </ul> </li> </ul> <p>If you discover injected scripts, preserve the evidence, note timestamps, and follow the containment steps above.</p> </section> <section id="hardening"> <h2 id="hardening-and-prevention-wordpress-best-practices">Hardening and prevention (WordPress best practices)</h2> <ul> <li><strong>Principle of least privilege:</strong> Limit the number of admin accounts. Use Editor-level accounts for content editors and separate accounts for site ops.</li> <li><strong>Multi-Factor Authentication:</strong> Enforce MFA for all administrator-level users.</li> <li><strong>Strong password policy:</strong> Use a password manager and enforce unique, long passwords.</li> <li><strong>Reduce admin exposure:</strong> Restrict /wp-admin and /wp-login.php by IP where possible, or present an HTTP basic authentication layer.</li> <li><strong>Regular plugin hygiene:</strong> Remove unused plugins and themes; only install plugins from reputable sources and check reviews, active installs, and last updated date.</li> <li><strong>Regular updates:</strong> Keep WordPress core, themes, and plugins updated. Automate minor and security updates where possible.</li> <li><strong>Harden file and filesystem permissions:</strong> Ensure file permissions are restrictive (files 644, folders 755) and ownerships are correct for your hosting environment.</li> <li><strong>Content sanitization practices for developers:</strong> Always sanitize input using <code>sanitize_text_field()</code>, <code>wp_kses_post()</code>, or custom <code>wp_kses()</code> rules. Escape output with <code>esc_html()</code>, <code>esc_attr()</code>, <code>esc_url()</code>. Verify capability checks (<code>current_user_can()</code>) and use nonces for admin POSTs.</li> <li><strong>Logging and monitoring:</strong> Enable audit logging and review admin actions regularly. Monitor file integrity and alert on unexpected changes.</li> </ul> </section> <section id="waf-rules"> <h2 id="waf-rules-and-virtual-patch-suggestions-recommended-rule-patterns">WAF rules and virtual patch suggestions (recommended rule patterns)</h2> <p>If the vendor patch is not yet available or you prefer layered defence, apply web-layer rules that mitigate stored XSS in admin inputs. Tune rules to avoid false positives.</p> <ol> <li><strong>Block script tag payloads in admin POSTs</strong> <ul> <li>Condition: Request URI matches admin plugin endpoints or options.php and HTTP POST body contains “<code><script</code>” or “<code>javascript:</code>” or “<code>onerror=</code>“.</li> <li>Action: Block or challenge (captcha) with a 403/Challenge response.</li> </ul> </li> <li><strong>Block common XSS payload encodings</strong> <ul> <li>Look for encoded forms like <code>%3Cscript%3E</code>, <code>\x3cscript</code>, or base64 payloads in POST content. Deny requests if payload is detected in plugin option keys or metadata fields.</li> </ul> </li> <li><strong>Limit allowed characters for SEO fields</strong> <ul> <li>Many plugin fields (keywords, tags, meta descriptions) should allow only safe characters — letters, numbers, punctuation. Block angle brackets (<code><</code>, <code>></code>) and on* attributes.</li> <li>Example rule: Deny POST where meta_description matches /[<>]/ or contains “onmouseover|onerror|javascript:”.</li> </ul> </li> <li><strong>Protect plugin settings pages specifically</strong> <ul> <li>If the plugin admin pages are detected at <code>/wp-admin/admin.php?page=sentence-to-seo</code> (example), apply stricter POST filters and rate limits on settings saves.</li> </ul> </li> <li><strong>Protect administrator sessions</strong> <ul> <li>Block suspicious IPs, geolocations, or UA strings with excessive admin POST activity. Enforce 2FA checkpoints for settings modifications where possible.</li> </ul> </li> <li><strong>Logging & alerting</strong> <ul> <li>Log and alert on every blocked POST to plugin admin pages containing suspicious patterns for manual review.</li> </ul> </li> </ol> <p>Note: Virtual patching is a temporary mitigation and not a substitute for a vendor fix. Once the plugin is updated, remove temporary rules that interfere with legitimate functionality.</p> </section> <section id="incident-response"> <h2 id="incident-response-playbook-if-you-suspect-compromise">Incident response playbook (if you suspect compromise)</h2> <ol> <li><strong>Triage</strong> <ul> <li>Take site offline or enable maintenance mode if public safety is a concern.</li> <li>Capture current system state: database dump, file listing, access logs.</li> </ul> </li> <li><strong>Contain</strong> <ul> <li>Disable the vulnerable plugin; block admin access from public Internet if possible.</li> <li>Rotate admin credentials and API keys.</li> </ul> </li> <li><strong>Analyze</strong> <ul> <li>Identify persistence mechanisms: scheduled tasks, new plugin/theme files, modified core files.</li> <li>Look for webshells or unknown PHP files in uploads, themes, or wp-content.</li> </ul> </li> <li><strong>Eradicate</strong> <ul> <li>Remove or quarantine malicious files.</li> <li>Clean injected database values and remove unauthorized users.</li> </ul> </li> <li><strong>Recover</strong> <ul> <li>Restore from clean backup, or after cleaning, continue to monitor in an isolated environment and then re-enable live traffic.</li> </ul> </li> <li><strong>Lessons learned</strong> <ul> <li>Document the attack chain and strengthen defenses: MFA adoption, admin access hardening, plugin update policy.</li> </ul> </li> <li><strong>Notify</strong> <ul> <li>If sensitive data was exposed, comply with reporting requirements applicable to your jurisdiction.</li> </ul> </li> <li><strong>Post‑incident monitoring</strong> <ul> <li>Keep elevated monitoring for at least 30 days and review logs for signs of re‑entry.</li> </ul> </li> </ol> </section> <section id="developer-tips"> <h2 id="practical-code-checks-and-developer-tips">Practical code checks and developer tips</h2> <p>If you maintain plugins or custom themes, follow these code-level rules to avoid similar vulnerabilities:</p> <ul> <li><strong>Always sanitize inputs</strong>: <ul> <li>For simple text: <code>sanitize_text_field( $_POST['field'] );</code></li> <li>For limited HTML: <code>wp_kses( $_POST['field'], $allowed_html );</code></li> </ul> </li> <li><strong>Escape outputs appropriately</strong>: <ul> <li><code>esc_html()</code> for element content.</li> <li><code>esc_attr()</code> for attribute values.</li> <li><code>esc_url()</code> for URLs.</li> </ul> </li> <li><strong>Use nonces and capability checks for all admin actions</strong>: <ul> <li><code>check_admin_referer( 'my_action_nonce' );</code></li> <li><code>if ( ! current_user_can( 'manage_options' ) ) { wp_die( 'Insufficient permissions' ); }</code></li> </ul> </li> <li><strong>Avoid echoing unsanitized admin options</strong>: <ul> <li><code>echo esc_attr( get_option( 'my_plugin_setting' ) );</code></li> </ul> </li> <li><strong>Constrain allowed characters in SEO fields</strong>: <ul> <li>Use <code>preg_replace</code> to strip angle brackets and event handler attributes from fields that should be plain text.</li> </ul> </li> </ul> <p>Example: sanitize and save meta safely:</p> <pre><code><?php if ( isset( $_POST['my_meta_field'] ) && check_admin_referer( 'my_meta_nonce', 'my_meta_nonce_field' ) ) { if ( current_user_can( 'edit_post', $post_id ) ) { $clean_value = wp_kses( $_POST['my_meta_field'], array() ); // no tags allowed update_post_meta( $post_id, 'my_meta_field', $clean_value ); } } ?></code></pre> <p>If your plugin genuinely needs HTML in user content, define a safe allowed tags array and use <code>wp_kses()</code> with a conservative list.</p> </section> <section id="final-notes"> <h2 id="final-notes">Final notes</h2> <ul> <li>Prioritize patching: When the plugin author ships an official fix, update as soon as possible.</li> <li>Do not rely on any single control: hardening, web-layer protections, and monitoring together reduce risk.</li> <li>Protect admin accounts proactively: mandate MFA and reduce admin user count.</li> <li>Regularly audit your plugins and remove unused ones.</li> <li>If you lack in-house security expertise, engage a qualified security professional for detection, containment, and remediation.</li> </ul> <p>If you found this guide useful, save it and share with other site owners in your organisation. Vulnerabilities like authenticated stored XSS are easier to manage when multiple layers of defence are in place — and when every admin account follows strong security practices.</p> <footer> <p>Stay safe,<br />Hong Kong Security Expert</p> </footer> </section> </article> </div> <section class="post-tags"><ul><li><h5 class="title-tags">標籤：</h5></li><li><a href="https://wp-security.org/zh/tag/wordpress-security/" rel="tag">WordPress Security</a></li></ul></section> <div class="pk-share-buttons-wrap pk-share-buttons-layout-default pk-share-buttons-scheme-bold-bg pk-share-buttons-has-counts pk-share-buttons-has-total-counts pk-share-buttons-after-post pk-share-buttons-mode-php pk-share-buttons-mode-rest" data-post-id="4190" data-share-url="https://wp-security.org/zh/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" > <div class="pk-share-buttons-total pk-share-buttons-total-no-count"> <div class="pk-share-buttons-count cs-font-primary">0 Shares:</div> </div> <div class="pk-share-buttons-items"> <div class="pk-share-buttons-item pk-share-buttons-facebook pk-share-buttons-no-count" data-id="facebook"> <a href="https://www.facebook.com/sharer.php?u=https://wp-security.org/zh/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="pk-share-buttons-link" target="_blank"> <i class="pk-share-buttons-icon pk-icon pk-icon-facebook"></i> <span class="pk-share-buttons-label pk-font-primary">分享</span> <span class="pk-share-buttons-count pk-font-secondary">0</span> </a> </div> <div class="pk-share-buttons-item pk-share-buttons-twitter pk-share-buttons-no-count" data-id="twitter"> <a href="https://x.com/share?&text=%3Ctrp-post-container%20data-trp-post-id%3D%274190%27%3EHong%20Kong%20NGO%20Alert%20XSS%20in%20Plugin%28CVE20264142%29%3C%2Ftrp-post-container%3E&url=https://wp-security.org/zh/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="pk-share-buttons-link" target="_blank"> <i class="pk-share-buttons-icon pk-icon pk-icon-twitter"></i> <span class="pk-share-buttons-label pk-font-primary">推文</span> <span class="pk-share-buttons-count pk-font-secondary">0</span> </a> </div> <div class="pk-share-buttons-item pk-share-buttons-pinterest pk-share-buttons-no-count" data-id="pinterest"> <a href="https://pinterest.com/pin/create/bookmarklet/?url=https://wp-security.org/zh/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/&media=https://wp-security.org/wp-content/uploads/2026/04/2026-04-22CVE20264142Sentence-To-SEO-keywords-description-and-tags-1024x576.jpg" class="pk-share-buttons-link" target="_blank"> <i class="pk-share-buttons-icon pk-icon pk-icon-pinterest"></i> <span class="pk-share-buttons-label pk-font-primary">固定</span> <span class="pk-share-buttons-count pk-font-secondary">0</span> </a> </div> </div> </div> <section class="post-author"> <div class="authors-compact"> <div class="author-wrap"> <div class="author"> <div class="author-avatar"> <a href="https://wp-security.org/zh/author/wp-security/" rel="author"> <img alt='' src='https://secure.gravatar.com/avatar/16bf83a02c7c3aa39247769e866366c2ea8ccfb8bd88a16ef3ac35925a1da888?s=120&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/16bf83a02c7c3aa39247769e866366c2ea8ccfb8bd88a16ef3ac35925a1da888?s=240&d=mm&r=g 2x' class='avatar avatar-120 photo' height='120' width='120' decoding='async'/> </a> </div> <div class="author-description"> <h5 class="title-author"> <span class="fn"> <a href="https://wp-security.org/zh/author/wp-security/" rel="author"> WP Security Vulnerability Report </a> </span> </h5> <p class="note"></p> </div> </div> </div> </div> </section> <div id="disqus_thread"></div> </div> </div> </article> <div class="post-prev-next"> <a class="link-item prev-link" href="https://wp-security.org/zh/vulnerability-database/community-security-alert-mcatfilter-csrf-vulnerabilitycve20264139/"> <div class="link-content"> <div class="link-label"> <span class="link-arrow"></span><span class="link-text"> — 之前的文章</span> </div> <h2 class="entry-title"> Community Security Alert mCatFilter CSRF Vulnerability(CVE20264139) </h2> </div> </a> <a class="link-item next-link" href="https://wp-security.org/zh/vulnerability-database/community-advisory-csrf-in-woocommerce-order-exportcve20264140/"> <div class="link-content"> <div class="link-label"> <span class="link-text">下一篇文章 — </span><span class="link-arrow"></span> </div> <h2 class="entry-title"> Community Advisory CSRF in WooCommerce Order Export(CVE20264140) </h2> </div> </a> </div> <section class="post-archive archive-related"> <div class="archive-wrap"> <div class="title-block-wrap"> <h5 class="title-block"> 你可能也喜歡 </h5> </div> <div class="archive-main archive-list archive-heading-small archive-borders-enabled archive-shadow-enabled archive-scale-enabled"> <article class="entry-without-preview post-3741 post type-post status-publish format-standard has-post-thumbnail category-vulnerability-database tag-wordpress-security"> <div class="post-outer"> <div class="post-inner"> <div class="meta-category"><a class="category-style" href="https://wp-security.org/zh/category/vulnerability-database/"><span style="background-color:#EDF2FF" data-color="#EDF2FF" data-color-dark="#555555" class="char" data-scheme="default">W</span><span class="label">WordPress Vulnerability Database</span></a></div> <header class="entry-header"> <h2 class="entry-title"><a href="https://wp-security.org/zh/vulnerability-database/community-advisory-cross-site-scripting-in-loobekcve202625349/" rel="bookmark">Community Advisory Cross Site Scripting in Loobek(CVE202625349)</a></h2><ul class="post-meta"><li class="meta-date">3 月 22, 2026</li></ul> </header> <div class="entry-details"> <div class="entry-excerpt"> Cross Site Scripting (XSS) in WordPress Loobek Theme </div> </div> </div> </div> </article> <article class="entry-without-preview post-4117 post type-post status-publish format-standard has-post-thumbnail category-vulnerability-database tag-wordpress-security"> <div class="post-outer"> <div class="post-inner"> <div class="meta-category"><a class="category-style" href="https://wp-security.org/zh/category/vulnerability-database/"><span style="background-color:#EDF2FF" data-color="#EDF2FF" data-color-dark="#555555" class="char" data-scheme="default">W</span><span class="label">WordPress Vulnerability Database</span></a></div> <header class="entry-header"> <h2 class="entry-title"><a href="https://wp-security.org/zh/vulnerability-database/hong-kong-security-alert-kubio-access-flawcve20265427/" rel="bookmark">Hong Kong Security Alert Kubio Access Flaw(CVE20265427)</a></h2><ul class="post-meta"><li class="meta-date">4 月 17, 2026</li></ul> </header> <div class="entry-details"> <div class="entry-excerpt"> Broken Access Control in WordPress Kubio AI Page Builder Plugin </div> </div> </div> </div> </article> <article class="entry-without-preview post-4706 post type-post status-publish format-standard has-post-thumbnail category-vulnerability-database tag-wordpress-security"> <div class="post-outer"> <div class="post-inner"> <div class="meta-category"><a class="category-style" href="https://wp-security.org/zh/category/vulnerability-database/"><span style="background-color:#EDF2FF" data-color="#EDF2FF" data-color-dark="#555555" class="char" data-scheme="default">W</span><span class="label">WordPress Vulnerability Database</span></a></div> <header class="entry-header"> <h2 class="entry-title"><a href="https://wp-security.org/zh/vulnerability-database/community-alert-xss-in-visualizer-plugincve202624573/" rel="bookmark">Community Alert XSS in Visualizer Plugin(CVE202624573)</a></h2><ul class="post-meta"><li class="meta-date">5 月 20, 2026</li></ul> </header> <div class="entry-details"> <div class="entry-excerpt"> Cross Site Scripting (XSS) in WordPress Visualizer Plugin </div> </div> </div> </div> </article> <article class="entry-without-preview post-3518 post type-post status-publish format-standard has-post-thumbnail category-vulnerability-database tag-wordpress-security"> <div class="post-outer"> <div class="post-inner"> <div class="meta-category"><a class="category-style" href="https://wp-security.org/zh/category/vulnerability-database/"><span style="background-color:#EDF2FF" data-color="#EDF2FF" data-color-dark="#555555" class="char" data-scheme="default">W</span><span class="label">WordPress Vulnerability Database</span></a></div> <header class="entry-header"> <h2 class="entry-title"><a href="https://wp-security.org/zh/vulnerability-database/community-alert-wzone-arbitrary-file-deletioncve202627040/" rel="bookmark">Community Alert WZone Arbitrary File Deletion(CVE202627040)</a></h2><ul class="post-meta"><li class="meta-date">3 月 18, 2026</li></ul> </header> <div class="entry-details"> <div class="entry-excerpt"> Arbitrary File Deletion in WordPress WZone Plugin </div> </div> </div> </div> </article> <article class="entry-without-preview post-4037 post type-post status-publish format-standard has-post-thumbnail category-vulnerability-database tag-wordpress-security"> <div class="post-outer"> <div class="post-inner"> <div class="meta-category"><a class="category-style" href="https://wp-security.org/zh/category/vulnerability-database/"><span style="background-color:#EDF2FF" data-color="#EDF2FF" data-color-dark="#555555" class="char" data-scheme="default">W</span><span class="label">WordPress Vulnerability Database</span></a></div> <header class="entry-header"> <h2 class="entry-title"><a href="https://wp-security.org/zh/vulnerability-database/hong-kong-security-alert-ziggeo-access-flawcve20264124/" rel="bookmark">Hong Kong Security Alert Ziggeo Access Flaw(CVE20264124)</a></h2><ul class="post-meta"><li class="meta-date">4 月 10, 2026</li></ul> </header> <div class="entry-details"> <div class="entry-excerpt"> Broken Access Control in WordPress Ziggeo Plugin </div> </div> </div> </div> </article> <article class="entry-without-preview post-1834 post type-post status-publish format-standard has-post-thumbnail category-vulnerability-database tag-wordpress-security"> <div class="post-outer"> <div class="post-inner"> <div class="meta-category"><a class="category-style" href="https://wp-security.org/zh/category/vulnerability-database/"><span style="background-color:#EDF2FF" data-color="#EDF2FF" data-color-dark="#555555" class="char" data-scheme="default">W</span><span class="label">WordPress Vulnerability Database</span></a></div> <header class="entry-header"> <h2 class="entry-title"><a href="https://wp-security.org/zh/vulnerability-database/community-security-alert-dynamiapps-frontend-privilege-escalationcve202513342/" rel="bookmark">Community Security Alert DynamiApps Frontend Privilege Escalation(CVE202513342)</a></h2><ul class="post-meta"><li class="meta-date">12 月 3, 2025</li></ul> </header> <div class="entry-details"> <div class="entry-excerpt"> Privilege Escalation in WordPress Frontend Admin by DynamiApps Plugin </div> </div> </div> </div> </article> </div> </div> </section> </main> </div> </div> </div> </div> <footer id="colophon" class="site-footer"> <div class="footer-subscribe"> <div class="cs-container"> <div class="subscribe-wrap"> </div> </div> </div> <div class="footer-info"> <div class="cs-container"> <div class="site-info"> <div class="footer-col-info"> <span class="site-title footer-title" href="https://wp-security.org/zh/" rel="home"> <img src="https://wp-security.org/wp-content/uploads/2025/08/WP-Security-logo-1-e1754494371106.png" alt="WP Security" > </span> <div class="footer-copyright"> © 2025 WP-Security.org Disclaimer: WP-Security.org is an independent, non-profit NGO community committed to sharing WordPress security news and information. We are not affiliated with WordPress, its parent company, or any related entities. All trademarks are the property of their respective owners. </div> </div> </div> </div> </div> </footer> </div> </div> </div> <template id="tp-language" data-tp-language="zh_HK"></template><script type="speculationrules"> {"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/zh/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/squaretype/*","/zh/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]} </script> <a href="#top" class="pk-scroll-to-top"> <i class="pk-icon pk-icon-up"></i> </a> <div class="pk-mobile-share-overlay"> </div> <script type="text/javascript"> var _paq = _paq || []; _paq.push(['setCustomDimension', 1, '{"ID":3,"name":"WP Security Vulnerability Report","avatar":"f7de7e299d4a4b4c92c6f2c2a29a7ca7"}']); _paq.push(['trackPageView']); (function () { var u = "https://analytics2.wpmudev.com/"; _paq.push(['setTrackerUrl', u + 'track/']); _paq.push(['setSiteId', '24942']); var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0]; g.type = 'text/javascript'; g.async = true; g.defer = true; g.src = 'https://analytics.wpmucdn.com/matomo.js'; s.parentNode.insertBefore(g, s); })(); </script> <script id='kirki-viewport-lists'>var kirkiViewports = {"md":{"value":1200,"scale":1,"minWidth":1200,"maxWidth":1200,"title":"Desktop","icon":"desktop","activeIcon":"desktop-hover","id":"md","type":"max"},"tablet":{"value":991,"scale":1,"minWidth":991,"maxWidth":991,"title":"Tablet","icon":"tablet-default","activeIcon":"tablet-hover","type":"max","id":"tablet"},"mobileLandscape":{"value":767,"scale":1,"minWidth":767,"maxWidth":767,"title":"Landscape","icon":"phone-hr-default","activeIcon":"phone-hr-hover","type":"max","id":"mobileLandscape"},"mobile":{"value":575,"scale":1,"minWidth":575,"maxWidth":575,"title":"Mobile","icon":"phone-vr-default","activeIcon":"phone-vr-hover","type":"max","id":"mobile"}};</script><script id='kirki-variable-lists'>var kirkiCSSVariable = {"data":[{"title":"Colors","key":"color","modes":[{"title":"Default","key":"default"}],"variables":[]},{"title":"Numbers","key":"size","modes":[{"title":"Default","key":"default"}],"variables":[]},{"title":"Text Styles","key":"text-style","modes":[{"title":"Default","key":"default"}],"variables":[]},{"title":"Font Family","key":"font-family","modes":[{"title":"Default","key":"default"}],"variables":[]}]};</script><script id="kirki-api-and-nonce"> window.wp_kirki = { ajaxUrl: "https://wp-security.org/wp-admin/admin-ajax.php", restUrl: "https://wp-security.org/zh/wp-json/", siteUrl: "https://wp-security.org", apiVersion: "v1", postId: "4190", nonce: "700cb694a4", call_from: "", templateId: "", context: {"id":4190,"type":"post"} }; </script><script id="wp-importmap" type="importmap"> {"imports":{"@wordpress/interactivity":"https://wp-security.org/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=efaa5193bbad9c60ffd1","@surecart/checkout":"https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/checkout/index.js?ver=3bbe28b8db1e11147c67","@surecart/checkout-events":"https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/checkout-events/index.js?ver=ed9647bd6c7865efe2ad","@surecart/checkout-service":"https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/checkout-actions/index.js?ver=e445a0ee0396d75d52c0","@surecart/google-events":"https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/google/index.js?ver=d92e383a18bcf54ea538","@surecart/facebook-events":"https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/facebook/index.js?ver=cf5c6499cb7b867894c1","@wordpress/a11y":"https://wp-security.org/wp-includes/js/dist/script-modules/a11y/index.min.js?ver=1c371cb517a97cdbcb9f","@surecart/api-fetch":"https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/fetch/index.js?ver=1bfba8ea0694a193022a"}} </script> <script id="@surecart/line-item-note-js-module" src="https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/line-item-note/index.js?ver=af6cf14267b5a9ad219f" type="module"></script> <script id="@surecart/checkout-js-module" src="https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/checkout/index.js?ver=3bbe28b8db1e11147c67" type="module"></script> <script id="@surecart/cart-js-module" src="https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/cart/index.js?ver=c2f35b71b4309df849fe" type="module"></script> <script id="@surecart/order-bumps-js-module" src="https://wp-security.org/wp-content/plugins/surecart/packages/blocks-next/build/scripts/order-bumps/index.js?ver=c639def39210a6244eb2" type="module"></script> <script id="wp-script-module-data-@wordpress/interactivity" type="application/json"> {"state":{"surecart/order-bumps":{"currentPage":1,"perPage":3},"surecart/checkout":{"checkout":{"line_items":{"data":[]}},"discountIsRedeemable":false,"isDiscountApplied":false,"hasDiscountAmount":false,"hasSubtotalScratchAmount":false,"itemsCount":0,"hasItems":false}}} </script> <div id="fb-root"></div> <script async defer crossorigin="anonymous" src="https://connect.facebook.net/zh_HK/sdk.js#xfbml=1&version=v17.0&appId=&autoLogAppEvents=1" nonce="Ci8te34e"></script> <script> window.scFetchData = {"root_url":"https:\/\/wp-security.org\/zh\/wp-json\/","nonce":"700cb694a4","nonce_endpoint":"https:\/\/wp-security.org\/wp-admin\/admin-ajax.php?action=sc-rest-nonce"} </script>  <div data-wp-context='{"formId":131,"mode":"live"}' data-wp-interactive='{ "namespace": "surecart/checkout" }' data-wp-init="callbacks.init" data-wp-watch="callbacks.onChangeCheckout" data-wp-on-window--storage="callbacks.syncTabs" class="sc-cart-wrapper is-layout-flow wp-container-surecart-slide-out-cart-is-layout-c8108a87 wp-block-surecart-slide-out-cart-is-layout-flow" > <div style="font-size:15px;width: 525px" class="sc-drawer sc-cart-drawer wp-block-surecart-slide-out-cart" role="dialog" data-wp-bind--aria-label="surecart/cart::state.ariaLabel" data-wp-class--open="surecart/cart::state.open" data-wp-on--keydown="surecart/cart::actions.handleKeydown" >  <div class="sc-alert sc-alert__alert--danger" role="alert" aria-live="assertive" aria-atomic="true" data-wp-bind--hidden="!state.error" hidden> <div class="sc-alert__icon"> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <circle cx="12" cy="12" r="10" /> <line x1="12" y1="8" x2="12" y2="12" /> <line x1="12" y1="16" x2="12.01" y2="16" /> </svg> </div> <div class="sc-alert__text"> <div class="sc-alert__title"> <span data-wp-text="state.errorTitle"></span> </div> <div class="sc-alert__message"> <div data-wp-text="state.errorMessage"></div> <template data-wp-each--message="state.additionalErrors"> <div> <span data-wp-text="context.message"></span> </div> </template> </div> </div> </div> <div class="wp-block-group is-content-justification-space-between is-nowrap is-layout-flex wp-container-core-group-is-layout-64e1162d wp-block-group-is-layout-flex" style="padding-top:1.5em;padding-right:2em;padding-bottom:0em;padding-left:2em"> <div style="line-height:1" class="wp-block-surecart-cart-close-button" data-wp-on--click="surecart/cart::actions.toggle" data-wp-on--keypress="surecart/cart::actions.toggle" role="button" tabindex="0" aria-label="關閉購物車" > <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <line x1="5" y1="12" x2="19" y2="12" /> <polyline points="12 5 19 12 12 19" /> </svg> </div> <p class="wp-block-paragraph" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px;padding-top:0px;padding-right:0px;padding-bottom:0px;padding-left:0px;font-size:16px;font-style:normal;font-weight:500;line-height:1"> 查看我的訂單</p> <span style="font-size:14px;font-weight:600;line-height:1;border-radius:4px;padding-top:6px;padding-bottom:6px;padding-left:10px;padding-right:10px" class="wp-block-surecart-cart-count" data-wp-text="state.itemsCount">0</span> </div> <div class="wp-block-group wp-container-content-9cfa9a5a"><div class="wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow"> <div style="padding-top:2em;padding-bottom:2em;padding-left:2em;padding-right:2em" class="wp-block-surecart-slide-out-cart-line-items is-layout-flow wp-container-surecart-slide-out-cart-line-items-is-layout-2e48a420 wp-block-surecart-slide-out-cart-line-items-is-layout-flow" role="list"> <template data-wp-each--line_item="state.checkoutLineItems" data-wp-each-key="context.line_item.id" > <div class="sc-product-line-item" data-wp-class--sc-product-line-item--has-swap="state.swap" role="listitem" data-wp-bind--aria-label="state.lineItemAriaLabel"> <div class="sc-product-line-item__content"> <div class="wp-block-group wp-container-content-9cfa9a5a"><div class="wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow"> <div class="wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-92927b4a wp-block-group-is-layout-flex"> <figure class="sc-cart-line-item-image-wrap wp-container-content-962be591 wp-duotone-unset-1" data-wp-bind--hidden="!context.line_item.image.src"> <img style="margin-top:0;margin-bottom:0;aspect-ratio:1;border-radius:4px;border-width:1px;margin-top:0;margin-bottom:0" class="sc-is-covered wp-block-surecart-cart-line-item-image" data-wp-bind--alt="context.line_item.image.alt" data-wp-bind--srcset="context.line_item.image.srcset" data-wp-bind--sizes="context.line_item.image.sizes" data-wp-bind--src="context.line_item.image.src" loading="lazy" /> </figure> <div class="wp-block-group wp-container-content-9cfa9a5a is-vertical is-content-justification-stretch is-nowrap is-layout-flex wp-container-core-group-is-layout-41c7e08e wp-block-group-is-layout-flex"> <div class="wp-block-group wp-container-content-9cfa9a5a is-content-justification-space-between is-nowrap is-layout-flex wp-container-core-group-is-layout-53e22457 wp-block-group-is-layout-flex"> <div class="wp-block-group wp-container-content-9cfa9a5a"><div class="wp-block-group__inner-container is-layout-flow wp-container-core-group-is-layout-c8108a87 wp-block-group-is-layout-flow"> <a style="font-style:normal;font-weight:500;line-height:1.4;text-decoration:none" class="wp-block-surecart-cart-line-item-title" data-wp-bind--href="state.lineItemPermalink"> <span data-wp-text="context.line_item.price.product.name"></span> </a> <div class="wp-block-group"><div class="wp-block-group__inner-container is-layout-flow wp-container-core-group-is-layout-c8108a87 wp-block-group-is-layout-flow"> <div style="font-size:14px;line-height:1.4" class="wp-block-surecart-cart-line-item-price-name" data-wp-text="state.lineItemPriceName" data-wp-bind--hidden="!state.lineItemPriceName"></div> <div style="font-size:14px;line-height:1.4" class="wp-block-surecart-cart-line-item-variant" data-wp-text="state.lineItemVariant" data-wp-bind--hidden="!state.lineItemVariant"></div> <div data-wp-interactive='{ "namespace": "surecart/line-item-note" }' style="font-size:14px;line-height:1.4" class="wp-block-surecart-cart-line-item-note" data-wp-context='{}' data-wp-run="callbacks.init" data-wp-class--line-item-note--is-expanded="context.noteExpanded" data-wp-class--line-item-note--is-collapsible="context.showToggle" data-wp-bind--hidden="surecart/checkout::!state.lineItemNote" data-wp-on--click="actions.toggleNoteExpanded" data-wp-on--keydown="actions.toggleNoteExpanded" data-wp-bind--role="button" data-wp-bind--disabled="!context.showToggle" data-wp-bind--aria-expanded="context.noteExpanded" data-wp-bind--aria-label="Toggle note visibility" tabindex="0" > <div class="line-item-note__text" data-wp-text="surecart/checkout::state.lineItemNote" ></div> <span class="sc-icon" data-wp-class--sc-icon--rotated="context.noteExpanded" > <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <polyline points="6 9 12 15 18 9" /> </svg> </span> </div> </div></div> <div class="sc-product-line-item__purchasable-status wp-block-surecart-cart-line-item-status has-text-align-right" data-wp-text="context.line_item.purchasable_status_display" data-wp-bind--hidden="!context.line_item.purchasable_status_display" role="status" aria-live="polite" aria-atomic="true" > </div> </div></div> <div class="wp-block-group"><div class="wp-block-group__inner-container is-layout-flow wp-container-core-group-is-layout-c8108a87 wp-block-group-is-layout-flow"> <div class="wp-block-group is-content-justification-right is-nowrap is-layout-flex wp-container-core-group-is-layout-f843080e wp-block-group-is-layout-flex" style="line-height:1.4"> <div class="wp-block-surecart-cart-line-item-scratch-amount" data-wp-text="context.line_item.scratch_display_amount" data-wp-bind--hidden="!state.lineItemHasScratchAmount" ></div> <div style="font-style:normal;font-weight:500" class="wp-block-surecart-cart-line-item-amount has-text-align-right" data-wp-text="context.line_item.subtotal_display_amount"></div> <div style="font-size:14px" class="wp-block-surecart-cart-line-item-interval" data-wp-bind--hidden="!context.line_item.price.short_interval_text"> <span class="wp-block-surecart-cart-line-item-interval__interval" data-wp-bind--hidden="!context.line_item.price.short_interval_text" data-wp-text="context.line_item.price.short_interval_text" ></span> <span class="wp-block-surecart-cart-line-item-interval__count" data-wp-bind--hidden="!context.line_item.price.short_interval_count_text" data-wp-text="context.line_item.price.short_interval_count_text" ></span> </div> </div> <div class="wp-block-group"><div class="wp-block-group__inner-container is-layout-flow wp-container-core-group-is-layout-c8108a87 wp-block-group-is-layout-flow"> <div style="font-size:14px" class="wp-block-surecart-cart-line-item-trial has-text-align-right" data-wp-bind--hidden="!context.line_item.price.trial_text" data-wp-text="context.line_item.price.trial_text" ></div> <template data-wp-each--fee="state.lineItemFees" data-wp-each-key="context.fee.id" > <div style="font-size:14px" class="wp-block-surecart-cart-line-item-fees has-text-align-right"> <span style="font-size:14px" class="wp-block-surecart-cart-line-item-fees has-text-align-right" data-wp-text="context.fee.display_amount" ></span> <span style="font-size:14px" class="wp-block-surecart-cart-line-item-fees has-text-align-right" data-wp-text="context.fee.description" ></span> </div> </template> </div></div> </div></div> </div> <div class="wp-block-group is-content-justification-space-between is-nowrap is-layout-flex wp-container-core-group-is-layout-e5460375 wp-block-group-is-layout-flex"> <div class="wp-block-group wp-container-content-9cfa9a5a"><div class="wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow"><div class="sc-input-group sc-input-group-sm sc-quantity-selector wp-block-surecart-cart-line-item-quantity" data-wp-class--quantity--disabled="state.isQuantityDisabled" data-wp-bind--hidden="!state.isEditable" hidden="1"> <div class="sc-input-group-text sc-quantity-selector__decrease" role="button" tabindex="0" data-wp-on--click="surecart/checkout::actions.onQuantityDecrease" data-wp-on--keydown="surecart/checkout::actions.onQuantityDecrease" data-wp-bind--disabled="state.isQuantityDecreaseDisabled" data-wp-bind--aria-disabled="state.isQuantityDecreaseDisabled" data-wp-class--button--disabled="state.isQuantityDecreaseDisabled" data-wp-bind--aria-label="surecart/checkout::state.decreaseQuantityAriaLabel" > <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <line x1="5" y1="12" x2="19" y2="12" /> </svg> </div> <input type="number" class="sc-form-control sc-quantity-selector__control" data-wp-bind--value="context.line_item.quantity" data-wp-on--change="surecart/checkout::actions.onQuantityChange" data-wp-bind--min="context.line_item.min" data-wp-bind--aria-valuemin="context.line_item.min" data-wp-bind--max="context.line_item.max" data-wp-bind--aria-valuemax="context.line_item.max" data-wp-bind--aria-valuenow="context.line_item.quantity" data-wp-bind--disabled="surecart/checkout::state.loading" data-wp-bind--aria-label="surecart/checkout::state.quantityInputAriaLabel" step="1" autocomplete="off" role="spinbutton" /> <div class="sc-input-group-text sc-quantity-selector__increase" role="button" tabindex="0" data-wp-on--click="surecart/checkout::actions.onQuantityIncrease" data-wp-on--keydown="surecart/checkout::actions.onQuantityIncrease" data-wp-bind--disabled="state.isQuantityIncreaseDisabled" data-wp-bind--aria-disabled="state.isQuantityIncreaseDisabled" data-wp-class--button--disabled="state.isQuantityIncreaseDisabled" data-wp-bind--aria-label="surecart/checkout::state.increaseQuantityAriaLabel" > <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <line x1="12" y1="5" x2="12" y2="19" /> <line x1="5" y1="12" x2="19" y2="12" /> </svg> </div> </div> </div></div> <div class="wp-block-group is-vertical is-content-justification-right is-layout-flex wp-container-core-group-is-layout-4c9338fd wp-block-group-is-layout-flex"> <div style="font-size:14px;font-style:normal;font-weight:400" class="wp-block-surecart-cart-line-item-remove" data-wp-bind--aria-label="surecart/checkout::state.removeItemAriaLabel" data-wp-on--click="surecart/checkout::actions.removeLineItem" data-wp-on--keydown="surecart/checkout::actions.removeLineItem" role="button" tabindex="0" > <svg class="wp-block-surecart-cart-line-item-remove__icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <line x1="18" y1="6" x2="6" y2="18" /> <line x1="6" y1="6" x2="18" y2="18" /> </svg> <span class="wp-block-surecart-cart-line-item-remove__label"> 移除 </span> </div> </div> </div> </div> </div> </div></div> </div> <div class="sc-product-line-item__swap" data-wp-bind--hidden="!state.swap" hidden data-wp-on--click="actions.toggleSwap"> <div class="sc-product-line-item__swap-content"> <button type="button" class="sc-toggle" role="switch" aria-checked="false" data-wp-bind--aria-checked="context.line_item.swap" data-wp-class--sc-toggle--checked="context.line_item.swap"> <span class="sc-toggle__label">使用設置</span> <span aria-hidden="true" class="sc-toggle__knob"></span> </button> <span data-wp-text="state.swap.description"></span> </div> <div class="sc-product-line-item__swap-amount"> <span data-wp-text="state.swapDisplayAmount" class="sc-product-line-item__swap-amount-value"></span> <span data-wp-text="state.swapIntervalText" class="sc-product-line-item__swap-amount-interval"></span> <span data-wp-text="state.swapIntervalCountText" class="sc-product-line-item__swap-amount-interval-count"></span> </div> </div> </div> </template> </div> </div></div> <div class="wp-block-group" style="border-top-color:#b0b0b069;border-top-width:1px;padding-top:0em;padding-right:0em;padding-bottom:0em;padding-left:0em"><div class="wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow"> <div style="border-bottom-width:1px;border-bottom-color:#b0b0b069;padding-top:1.5em;padding-bottom:1.5em;padding-left:2em;padding-right:2em" class="wp-block-surecart-cart-order-bumps" data-wp-context='{"hideAddedItems":true}' data-wp-interactive='{ "namespace": "surecart/order-bumps" }' data-wp-init="callbacks.init" data-wp-bind--hidden="!state.hasOrderBumps" hidden> <div class="wp-block-group is-content-justification-space-between is-nowrap is-layout-flex wp-container-core-group-is-layout-768bb735 wp-block-group-is-layout-flex" style="margin-bottom:0.75em"> <p class="wp-block-paragraph" style="margin-top:0;margin-bottom:0;font-style:normal;font-weight:500">為您推薦</p> <nav class="wp-block-surecart-cart-order-bump-pagination is-layout-flex wp-container-surecart-cart-order-bump-pagination-is-layout-00ae689d wp-block-surecart-cart-order-bump-pagination-is-layout-flex" data-wp-bind--hidden="!state.showPagination" aria-label="訂單增值分頁" hidden> <div aria-disabled="true" disabled class="has-arrow-type-chevron wp-block-surecart-cart-order-bump-pagination-previous" data-wp-on--click="surecart/order-bumps::actions.previousPage" data-wp-on--keydown="surecart/order-bumps::actions.handlePreviousKeydown" data-wp-bind--disabled="!state.hasPreviousPage" data-wp-bind--aria-disabled="!state.hasPreviousPage" aria-label="上一頁" role="button" tabindex="0" > <svg aria-hidden="true" class="wp-block-surecart-cart-order-bump-pagination-previous__icon" xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <polyline points="15 18 9 12 15 6" /> </svg> </div> <div aria-disabled="true" disabled class="has-arrow-type-chevron wp-block-surecart-cart-order-bump-pagination-next" data-wp-on--click="surecart/order-bumps::actions.nextPage" data-wp-on--keydown="surecart/order-bumps::actions.handleNextKeydown" data-wp-bind--disabled="!state.hasNextPage" data-wp-bind--aria-disabled="!state.hasNextPage" aria-label="下一頁" role="button" tabindex="0" > <svg aria-hidden="true" class="wp-block-surecart-cart-order-bump-pagination-next__icon" xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <polyline points="9 18 15 12 9 6" /> </svg> </div> </nav> </div> <ul class="wp-block-surecart-cart-order-bump-template is-layout-flex wp-container-surecart-cart-order-bump-template-is-layout-e99f66c5 wp-block-surecart-cart-order-bump-template-is-layout-flex" role="list" data-wp-class--has-overflow="state.hasMultipleBumps" data-wp-on--scrollend="callbacks.onCarouselScroll" data-wp-on--keydown="actions.handleCarouselKeydown" tabindex="0" data-wp-bind--aria-label="state.orderBumpsListAriaLabel" > <template data-wp-each--bump="state.orderBumps" data-wp-each-key="context.bump.id" > <li class="sc-cart-order-bump-item" role="listitem"> <div class="wp-block-group has-border-color wp-container-content-9cfa9a5a is-nowrap is-layout-flex wp-container-core-group-is-layout-e91b8ce6 wp-block-group-is-layout-flex" style="border-color:#e0e0e0;border-width:1px;border-radius:12px;padding-top:0.75em;padding-right:1em;padding-bottom:0.75em;padding-left:0.75em"> <figure class="sc-cart-order-bump-image-wrap wp-container-content-d0d0a6b5" data-wp-bind--hidden="!context.bump.price.product.line_item_image.src"> <img style="aspect-ratio:1;width:72px;border-radius:8px" class="sc-is-covered wp-block-surecart-cart-order-bump-image" data-wp-bind--alt="context.bump.price.product.name" data-wp-bind--src="context.bump.price.product.line_item_image.src" loading="lazy" /> </figure> <div class="wp-block-group wp-container-content-9cfa9a5a is-vertical is-layout-flex wp-container-core-group-is-layout-0370e391 wp-block-group-is-layout-flex"> <span style="font-size:15px;font-weight:600;line-height:1.3" class="wp-block-surecart-cart-order-bump-title" data-wp-text="context.bump.name" ></span> <div style="color:#6b7280;font-size:13px;line-height:1.3" class="wp-block-surecart-cart-order-bump-description has-text-color" data-wp-bind--hidden="!context.bump.metadata.description" data-wp-text="context.bump.metadata.description" hidden></div> <div class="wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-0cf19278 wp-block-group-is-layout-flex"> <div style="font-size:14px" class="wp-block-surecart-cart-order-bump-scratch-amount" data-wp-text="context.bump.subtotal_display_amount" data-wp-bind--hidden="!state.bumpHasDiscount" ></div> <div style="font-size:14px;font-weight:500" class="wp-block-surecart-cart-order-bump-amount" data-wp-text="context.bump.total_display_amount"></div> </div> </div> <div style="font-size:18px;font-weight:400;border-color:#d1d5db;border-top-left-radius:74.6%;border-top-right-radius:74.6%;border-bottom-left-radius:74.6%;border-bottom-right-radius:74.6%;border-width:1px;padding-top:0.5em;padding-bottom:0.5em;padding-left:0.5em;padding-right:0.5em" class="sc-cart-order-bump-add-button wp-block-surecart-cart-order-bump-add-button has-border-color" role="button" tabindex="0" data-wp-on--click="surecart/order-bumps::actions.addBumpToCart" data-wp-on--keydown="surecart/order-bumps::actions.handleAddButtonKeydown" data-wp-bind--disabled="state.isBumpInCart" data-wp-bind--aria-disabled="state.isBumpInCart" data-wp-class--sc-cart-order-bump-add-button--added="state.isBumpInCart" data-wp-bind--aria-label="state.addButtonAriaLabel" aria-label="加入購物車" > <span class="sc-cart-order-bump-add-button__icon" aria-hidden="true" data-wp-bind--hidden="state.isBumpInCart"> <svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <line x1="12" y1="5" x2="12" y2="19" /> <line x1="5" y1="12" x2="19" y2="12" /> </svg> </span> <span class="sc-cart-order-bump-add-button__icon" aria-hidden="true" data-wp-bind--hidden="!state.isBumpInCart" hidden> <svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <polyline points="20 6 9 17 4 12" /> </svg> </span> </div> </div> </li> </template> </ul> </div> <div class="wp-block-group" style="margin-top:0;margin-bottom:0;padding-top:2em;padding-right:2em;padding-bottom:2em;padding-left:2em"><div class="wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-491b0754 wp-block-group-is-layout-constrained"> <div class="wp-block-surecart-slide-out-cart-items-subtotal is-content-justification-space-between is-nowrap is-layout-flex wp-container-surecart-slide-out-cart-items-subtotal-is-layout-0a93696a wp-block-surecart-slide-out-cart-items-subtotal-is-layout-flex"> <div class="wp-block-group"><div class="wp-block-group__inner-container is-layout-flow wp-container-core-group-is-layout-c8108a87 wp-block-group-is-layout-flow"> <p class="wp-block-paragraph" style="margin-top:0px;margin-bottom:0px;font-size:18px;font-style:normal;font-weight:500;line-height:1.4"> 小計</p> <p class="has-text-color has-link-color wp-elements-3ccbd622ec95a2fb9ce4984e15710a06 wp-block-paragraph" style="color:var(--sc-input-help-text-color);font-size:14px;line-height:1.4">稅金和運費在結帳時計算</p> </div></div> <div class="wp-block-group is-content-justification-right is-nowrap is-layout-flex wp-container-core-group-is-layout-f843080e wp-block-group-is-layout-flex"><span style="font-size:18px;line-height:1.4" class="wp-block-surecart-cart-subtotal-scratch-amount" data-wp-text="state.checkout.subtotal_scratch_display_amount" data-wp-bind--hidden="!state.hasSubtotalScratchAmount" data-wp-bind--aria-label="state.subtotalScratchAriaLabel" hidden></span> <span style="font-size:18px;font-style:normal;font-weight:500;line-height:1.4" class="wp-block-surecart-cart-subtotal-amount" data-wp-text="state.checkout.subtotal_display_amount"></span> </div> </div> <div class="sc-cart-items-submit__wrapper" style="" > <div class="wp-block-button"> <a style="border-radius:4px" class="wp-block-button__link wp-element-button sc-button__link wp-block-surecart-slide-out-cart-items-submit" href="https://wp-security.org/zh/checkout/" data-wp-bind--disabled="state.loading" data-wp-class--sc-button__link--busy="state.loading" > <span class="sc-spinner" aria-hidden="false"></span> <span class="sc-button__link-text">結帳</span> </a> </div> </div> </div></div> </div></div> <div class="sc-block-ui" data-wp-bind--hidden="!state.loading" hidden></div> </div>  <div class="sc-drawer__backdrop" data-wp-on--mousedown="surecart/cart::actions.closeOverlay" data-wp-on--touchstart="surecart/cart::actions.closeOverlay" data-wp-class--show="surecart/cart::state.open" data-wp-on--keydown="surecart/cart::actions.handleKeydown"></div> </div>  <div data-wp-interactive='{ "namespace": "surecart/checkout" }' class="wp-block-surecart-cart-icon" data-wp-context='{"formId":131,"mode":"live"}' data-wp-on--click="surecart/cart::actions.toggle" data-wp-on--keydown="surecart/cart::actions.toggle" tabindex="0" role="button" data-wp-bind--hidden="!state.hasItems" hidden> <div class="wp-block-surecart-cart-icon__container"> <div class="wp-block-surecart-cart-icon__icon" aria-label="購物車按鈕。."> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewbox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M6 2L3 6v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V6l-3-4z" /> <line x1="3" y1="6" x2="21" y2="6" /> <path d="M16 10a4 4 0 0 1-8 0" /> </svg> </div> <span class="wp-block-surecart-cart-icon__count" data-wp-text="state.itemsCount" data-wp-bind--aria-label="state.itemsCountAriaLabel" >0</span> </div> </div><script id="wp-url-js" src="https://wp-security.org/wp-includes/js/dist/url.min.js?ver=bb0f766c3d2efe497871"></script> <script id="wp-hooks-js" src="https://wp-security.org/wp-includes/js/dist/hooks.min.js?ver=7496969728ca0f95732d"></script> <script id="wp-i18n-js" src="https://wp-security.org/wp-includes/js/dist/i18n.min.js?ver=781d11515ad3d91786ec"></script> <script id="wp-i18n-js-after"> wp.i18n.setLocaleData( { 'text direction\u0004ltr': [ 'ltr' ] } ); //# sourceURL=wp-i18n-js-after </script> <script id="wp-api-fetch-js-translations"> ( function( domain, translations ) { var localeData = translations.locale_data[ domain ] || translations.locale_data.messages; localeData[""].domain = domain; wp.i18n.setLocaleData( localeData, domain ); } )( "default", {"translation-revision-date":"2022-07-15 14:05:27+0000","generator":"GlotPress\/4.0.1","domain":"messages","locale_data":{"messages":{"":{"domain":"messages","plural-forms":"nplurals=1; plural=0;","lang":"zh_HK"},"An unknown error occurred.":["\u767c\u751f\u672a\u77e5\u7684\u932f\u8aa4\u3002"],"The response is not a valid JSON response.":["\u7121\u6548\u7684 JSON \u56de\u61c9\u3002"],"Media upload failed. If this is a photo or a large image, please scale it down and try again.":["\u5a92\u9ad4\u4e0a\u8f09\u5931\u6557\u3002\u5982\u679c\u9019\u662f\u7167\u7247\u6216\u5927\u578b\u5c3a\u5bf8\u5716\u7247\uff0c\u8acb\u5148\u7e2e\u5c0f\u5c3a\u5bf8\u518d\u4e0a\u8f09\u3002"],"You are probably offline.":["\u9019\u500b\u7db2\u7ad9\u76ee\u524d\u53ef\u80fd\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002"]}},"comment":{"reference":"wp-includes\/js\/dist\/api-fetch.js"}} ); //# sourceURL=wp-api-fetch-js-translations </script> <script id="wp-api-fetch-js" src="https://wp-security.org/wp-includes/js/dist/api-fetch.min.js?ver=d7efe4dc1468d36c39b8"></script> <script id="wp-api-fetch-js-after"> wp.apiFetch.use( wp.apiFetch.createRootURLMiddleware( "https://wp-security.org/zh/wp-json/" ) ); wp.apiFetch.nonceMiddleware = wp.apiFetch.createNonceMiddleware( "700cb694a4" ); wp.apiFetch.use( wp.apiFetch.nonceMiddleware ); wp.apiFetch.use( wp.apiFetch.mediaUploadMiddleware ); wp.apiFetch.nonceEndpoint = "https://wp-security.org/wp-admin/admin-ajax.php?action=rest-nonce"; //# sourceURL=wp-api-fetch-js-after </script> <script id="wp-dom-ready-js" src="https://wp-security.org/wp-includes/js/dist/dom-ready.min.js?ver=a06281ae5cf5500e9317"></script> <script id="wp-a11y-js-translations"> ( function( domain, translations ) { var localeData = translations.locale_data[ domain ] || translations.locale_data.messages; localeData[""].domain = domain; wp.i18n.setLocaleData( localeData, domain ); } )( "default", {"translation-revision-date":"2022-07-15 14:05:27+0000","generator":"GlotPress\/4.0.1","domain":"messages","locale_data":{"messages":{"":{"domain":"messages","plural-forms":"nplurals=1; plural=0;","lang":"zh_HK"},"Notifications":["\u901a\u77e5"]}},"comment":{"reference":"wp-includes\/js\/dist\/a11y.js"}} ); //# sourceURL=wp-a11y-js-translations </script> <script id="wp-a11y-js" src="https://wp-security.org/wp-includes/js/dist/a11y.min.js?ver=af934e5259bc51b8718e"></script> <script id="trp-dynamic-translator-js-extra"> var trp_data = {"trp_custom_ajax_url":"https://wp-security.org/wp-content/plugins/translatepress-multilingual/includes/trp-ajax.php","trp_wp_ajax_url":"https://wp-security.org/wp-admin/admin-ajax.php","trp_language_to_query":"zh_HK","trp_original_language":"en_US","trp_current_language":"zh_HK","trp_skip_selectors":["[data-no-translation]","[data-no-dynamic-translation]","[data-trp-translate-id-innertext]","script","style","head","trp-span","translate-press","[data-trp-translate-id]","[data-trpgettextoriginal]","[data-trp-post-slug]"],"trp_base_selectors":["data-trp-translate-id","data-trpgettextoriginal","data-trp-post-slug"],"trp_attributes_selectors":{"text":{"accessor":"outertext","attribute":false},"block":{"accessor":"innertext","attribute":false},"image_src":{"selector":"img[src]","accessor":"src","attribute":true},"submit":{"selector":"input[type='submit'],input[type='button'], input[type='reset']","accessor":"value","attribute":true},"placeholder":{"selector":"input[placeholder],textarea[placeholder]","accessor":"placeholder","attribute":true},"title":{"selector":"[title]","accessor":"title","attribute":true},"a_href":{"selector":"a[href]","accessor":"href","attribute":true},"button":{"accessor":"outertext","attribute":false},"option":{"accessor":"innertext","attribute":false},"aria_label":{"selector":"[aria-label]","accessor":"aria-label","attribute":true},"video_src":{"selector":"video[src]","accessor":"src","attribute":true},"video_poster":{"selector":"video[poster]","accessor":"poster","attribute":true},"video_source_src":{"selector":"video source[src]","accessor":"src","attribute":true},"audio_src":{"selector":"audio[src]","accessor":"src","attribute":true},"audio_source_src":{"selector":"audio source[src]","accessor":"src","attribute":true},"picture_image_src":{"selector":"picture image[src]","accessor":"src","attribute":true},"picture_source_srcset":{"selector":"picture source[srcset]","accessor":"srcset","attribute":true}},"trp_attributes_accessors":["outertext","innertext","src","value","placeholder","title","href","aria-label","poster","srcset"],"gettranslationsnonceregular":"173be74acc","showdynamiccontentbeforetranslation":"","skip_strings_from_dynamic_translation":[],"skip_strings_from_dynamic_translation_for_substrings":{"href":["amazon-adsystem","googleads","g.doubleclick"]},"duplicate_detections_allowed":"100","trp_translate_numerals_opt":"no","trp_no_auto_translation_selectors":["[data-no-auto-translation]"]}; //# sourceURL=trp-dynamic-translator-js-extra </script> <script id="trp-dynamic-translator-js" src="https://wp-security.org/wp-content/plugins/translatepress-multilingual/assets/js/trp-translate-dom-changes.js?ver=3.2.1"></script> <script id="powerkit-js" src="https://wp-security.org/wp-content/plugins/powerkit/assets/js/_scripts.js?ver=3.0.7"></script> <script id="swv-js" src="https://wp-security.org/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.6"></script> <script id="contact-form-7-js-before"> var wpcf7 = { "api": { "root": "https:\/\/wp-security.org\/zh\/wp-json\/", "namespace": "contact-form-7\/v1" }, "cached": 1 }; //# sourceURL=contact-form-7-js-before </script> <script id="contact-form-7-js" src="https://wp-security.org/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.6"></script> <script id="disqus_count-js-extra"> var countVars = {"disqusShortname":"wp-security-org"}; //# sourceURL=disqus_count-js-extra </script> <script id="disqus_count-js" src="https://wp-security.org/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.1.4"></script> <script id="disqus_embed-js-extra"> var embedVars = {"disqusConfig":{"integration":"wordpress 3.1.4 7.0"},"disqusIdentifier":"4190 https://wp-security.org/uncategorized/hong-kong-ngo-alert-xss-in-plugincve20264142/","disqusShortname":"wp-security-org","disqusTitle":"Hong Kong NGO Alert XSS in Plugin(CVE20264142)","disqusUrl":"https://wp-security.org/zh/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/","postId":"4190"}; //# sourceURL=disqus_embed-js-extra </script> <script id="disqus_embed-js" src="https://wp-security.org/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.1.4"></script> <script id="powerkit-basic-elements-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/basic-elements/public/js/public-powerkit-basic-elements.js?ver=4.0.0"></script> <script id="justifiedgallery-js" src="https://wp-security.org/wp-content/plugins/canvas/components/justified-gallery/block/jquery.justifiedGallery.min.js?ver=2.5.3"></script> <script id="powerkit-justified-gallery-js-extra"> var powerkitJG = {"rtl":""}; //# sourceURL=powerkit-justified-gallery-js-extra </script> <script id="powerkit-justified-gallery-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/justified-gallery/public/js/public-powerkit-justified-gallery.js?ver=3.0.7"></script> <script id="imagesloaded-js" src="https://wp-security.org/wp-includes/js/imagesloaded.min.js?ver=5.0.0"></script> <script id="glightbox-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/lightbox/public/js/glightbox.min.js?ver=3.0.7"></script> <script id="powerkit-lightbox-js-extra"> var powerkit_lightbox_localize = {"text_previous":"Previous","text_next":"Next","text_close":"Close","text_loading":"Loading","text_counter":"of","single_image_selectors":".entry-content img,.single .post-media img","gallery_selectors":".wp-block-gallery,.gallery","exclude_selectors":".sight-portfolio-area","zoom_icon":"1"}; //# sourceURL=powerkit-lightbox-js-extra </script> <script id="powerkit-lightbox-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/lightbox/public/js/public-powerkit-lightbox.js?ver=3.0.7"></script> <script id="powerkit-opt-in-forms-js-extra"> var opt_in = {"ajax_url":"https://wp-security.org/wp-admin/admin-ajax.php","warning_privacy":"Please confirm that you agree with our policies.","is_admin":"","server_error":"Server error occurred. Please try again later."}; //# sourceURL=powerkit-opt-in-forms-js-extra </script> <script id="powerkit-opt-in-forms-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/opt-in-forms/public/js/public-powerkit-opt-in-forms.js?ver=3.0.7"></script> <script id="powerkit-pinterest-js" async="async" defer="defer" src="//assets.pinterest.com/js/pinit.js?ver=7.0"></script> <script id="powerkit-pin-it-js-extra"> var powerkit_pinit_localize = {"image_selectors":".entry-content img","exclude_selectors":".cnvs-block-row,.cnvs-block-section,.cnvs-block-posts .entry-thumbnail,.cnvs-post-thumbnail,.pk-block-author,.pk-featured-categories img,.pk-inline-posts-container img,.pk-instagram-image,.pk-subscribe-image,.wp-block-cover,.pk-block-posts,.sight-portfolio-entry-link-page","only_hover":"1"}; //# sourceURL=powerkit-pin-it-js-extra </script> <script id="powerkit-pin-it-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/pinterest/public/js/public-powerkit-pin-it.js?ver=3.0.7"></script> <script id="powerkit-scroll-to-top-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/scroll-to-top/public/js/public-powerkit-scroll-to-top.js?ver=3.0.7"></script> <script id="powerkit-share-buttons-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/share-buttons/public/js/public-powerkit-share-buttons.js?ver=3.0.7"></script> <script id="flickity-js" src="https://wp-security.org/wp-content/plugins/canvas/components/slider-gallery/block/flickity.pkgd.min.js?ver=2.5.3"></script> <script id="powerkit-slider-gallery-js-extra"> var powerkit_sg_flickity = {"page_info_sep":" of "}; //# sourceURL=powerkit-slider-gallery-js-extra </script> <script id="powerkit-slider-gallery-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/slider-gallery/public/js/public-powerkit-slider-gallery.js?ver=3.0.7"></script> <script id="powerkit-table-of-contents-js-extra"> var powerkit_toc_config = {"label_show":"Show","label_hide":"Hide"}; //# sourceURL=powerkit-table-of-contents-js-extra </script> <script id="powerkit-table-of-contents-js" src="https://wp-security.org/wp-content/plugins/powerkit/modules/table-of-contents/public/js/public-powerkit-table-of-contents.js?ver=3.0.7"></script> <script id="magnific-popup-js" src="https://wp-security.org/wp-content/plugins/sight/render/js/jquery.magnific-popup.min.js?ver=1774098503"></script> <script id="sight-block-script-js-extra"> var sight_lightbox_localize = {"text_previous":"Previous","text_next":"Next","text_close":"Close","text_loading":"Loading","text_counter":"of"}; //# sourceURL=sight-block-script-js-extra </script> <script id="sight-block-script-js" src="https://wp-security.org/wp-content/plugins/sight/render/js/sight.js?ver=1774098503"></script> <script id="colcade-js" src="https://wp-security.org/wp-content/plugins/canvas/components/posts/block-posts/colcade.js?ver=2.5.3"></script> <script id="object-fit-images-js" src="https://wp-security.org/wp-content/themes/squaretype/js/ofi.min.js?ver=3.2.3"></script> <script id="csco-scripts-js-extra"> var csco_mega_menu = {"rest_url":"https://wp-security.org/zh/wp-json/csco/v1/menu-posts","current_lang":"","current_locale":"zh_HK"}; //# sourceURL=csco-scripts-js-extra </script> <script id="csco-scripts-js" src="https://wp-security.org/wp-content/themes/squaretype/js/scripts.js?ver=3.1.1"></script> <script async data-wp-strategy="async" fetchpriority="low" id="comment-reply-js" src="https://wp-security.org/wp-includes/js/comment-reply.min.js?ver=7.0"></script> <script id="wp-emoji-settings" type="application/json"> {"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://wp-security.org/wp-includes/js/wp-emoji-release.min.js?ver=7.0"}} </script> <script type="module"> /*! This file is auto-generated */ const a=JSON.parse(document.getElementById("wp-emoji-settings").textContent),o=(window._wpemojiSettings=a,"wpEmojiSettingsSupports"),s=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const a=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===a[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,a){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!a(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,a){let r;const o=(r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),s=(o.textBaseline="top",o.font="600 32px Arial",{});return e.forEach(e=>{s[e]=t(o,e,n,a)}),s}function r(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}a.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),c.toString(),p.toString()].join(",")+"));",a=new Blob([e],{type:"text/javascript"});const r=new Worker(URL.createObjectURL(a),{name:"wpTestEmojiSupports"});return void(r.onmessage=e=>{i(n=e.data),r.terminate(),t(n)})}catch(e){}i(n=f(s,u,c,p))}t(n)}).then(e=>{for(const n in e)a.supports[n]=e[n],a.supports.everything=a.supports.everything&&a.supports[n],"flag"!==n&&(a.supports.everythingExceptFlag=a.supports.everythingExceptFlag&&a.supports[n]);var t;a.supports.everythingExceptFlag=a.supports.everythingExceptFlag&&!a.supports.flag,a.supports.everything||((t=a.source||{}).concatemoji?r(t.concatemoji):t.wpemoji&&t.twemoji&&(r(t.twemoji),r(t.wpemoji)))}); //# sourceURL=https://wp-security.org/wp-includes/js/wp-emoji-loader.min.js </script> <div style="position:absolute;margin:-1px;padding:0;height:1px;width:1px;overflow:hidden;clip-path:inset(50%);border:0;word-wrap:normal !important;"><p id="a11y-speak-intro-text" class="a11y-speak-intro-text" hidden data-no-translation="" data-trp-gettext="">通知</p><div id="a11y-speak-assertive" class="a11y-speak-region" aria-live="assertive" aria-relevant="additions text" aria-atomic="true"></div><div id="a11y-speak-polite" class="a11y-speak-region" aria-live="polite" aria-relevant="additions text" aria-atomic="true"></div></div>  <script type="text/javascript"> (function () { window.usermaven = window.usermaven || (function () { (window.usermavenQ = window.usermavenQ || []).push(arguments); }) var t = document.createElement('script'), s = document.getElementsByTagName('script')[0]; t.defer = true; t.id = 'um-tracker'; t.setAttribute('data-tracking-host', 'https://u.wp-security.org'); t.setAttribute('data-key', 'UMZaYew9Sp'); t.setAttribute('data-autocapture', 'true'); t.setAttribute('data-randomize-url', 'true'); t.src = 'https://u.wp-security.org/lib.js'; s.parentNode.insertBefore(t, s); })(); </script>  <nav class="trp-language-switcher trp-floating-switcher trp-ls-dropdown trp-switcher-position-bottom" style="--bg:#ffffffb2;--bg-hover:#0000000d;--text:#000000;--text-hover:#000000;--border:1px solid transparent;--border-radius:8px 8px 0px 0px;--flag-radius:2px;--flag-size:20px;--aspect-ratio:4/3;--font-size:16px;--switcher-width:auto;--switcher-padding:10px 0;--transition-duration:0.2s;--bottom:0px;--right:10vw" role="navigation" aria-label="網站語言選擇器" data-no-translation > <div class="trp-language-switcher-inner"> <div class="trp-language-item trp-language-item__current" title="Chinese (Hong Kong)" role="button" tabindex="0" aria-expanded="false" aria-label="Change language" aria-controls="trp-switcher-dropdown-list" data-no-translation><span class="trp-language-item-name">Chinese (Hong Kong)</span></div> <div class="trp-switcher-dropdown-list" id="trp-switcher-dropdown-list" role="group" aria-label="可用語言" hidden inert > <a href="https://wp-security.org/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="trp-language-item" title="English" data-no-translation><span class="trp-language-item-name">English</span></a> <a href="https://wp-security.org/zh_cn/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="trp-language-item" title="Chinese (China)" data-no-translation><span class="trp-language-item-name">Chinese (China)</span></a> <a href="https://wp-security.org/es/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="trp-language-item" title="Spanish" data-no-translation><span class="trp-language-item-name">Spanish</span></a> <a href="https://wp-security.org/hi/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="trp-language-item" title="Hindi" data-no-translation><span class="trp-language-item-name">Hindi</span></a> <a href="https://wp-security.org/fr/vulnerability-database/hong-kong-ngo-alert-xss-in-plugincve20264142/" class="trp-language-item" title="French" data-no-translation><span class="trp-language-item-name">French</span></a> </div> </div> </nav> <script type="text/javascript"> "use strict"; (function($) { $( window ).on( 'load', function() { // Each All Share boxes. $( '.pk-share-buttons-mode-rest' ).each( function() { var powerkitButtonsIds = [], powerkitButtonsBox = $( this ); // Check Counts. if ( ! powerkitButtonsBox.hasClass( 'pk-share-buttons-has-counts' ) && ! powerkitButtonsBox.hasClass( 'pk-share-buttons-has-total-counts' ) ) { return; } powerkitButtonsBox.find( '.pk-share-buttons-item' ).each( function() { if ( $( this ).attr( 'data-id' ).length > 0 ) { powerkitButtonsIds.push( $( this ).attr( 'data-id' ) ); } }); // Generate accounts data. var powerkitButtonsData = {}; if( powerkitButtonsIds.length > 0 ) { powerkitButtonsData = { 'ids' : powerkitButtonsIds.join(), 'post_id' : powerkitButtonsBox.attr( 'data-post-id' ), 'url' : powerkitButtonsBox.attr( 'data-share-url' ), }; } // Get results by REST API. $.ajax({ type: 'GET', url: 'https://wp-security.org/zh/wp-json/social-share/v1/get-shares', data: powerkitButtonsData, beforeSend: function(){ // Add Loading Class. powerkitButtonsBox.addClass( 'pk-share-buttons-loading' ); }, success: function( response ) { if ( ! $.isEmptyObject( response ) && ! response.hasOwnProperty( 'code' ) ) { // Accounts loop. $.each( response, function( index, data ) { if ( index !== 'total_count' ) { // Find Bsa Item. var powerkitButtonsItem = powerkitButtonsBox.find( '.pk-share-buttons-item[data-id="' + index + '"]'); // Set Count. if ( data.hasOwnProperty( 'count' ) && data.count ) { powerkitButtonsItem.removeClass( 'pk-share-buttons-no-count' ).addClass( 'pk-share-buttons-item-count' ); powerkitButtonsItem.find( '.pk-share-buttons-count' ).html( data.count ); } else { powerkitButtonsItem.addClass( 'pk-share-buttons-no-count' ); } } }); if ( powerkitButtonsBox.hasClass( 'pk-share-buttons-has-total-counts' ) && response.hasOwnProperty( 'total_count' ) ) { var powerkitButtonsTotalBox = powerkitButtonsBox.find( '.pk-share-buttons-total' ); if ( response.total_count ) { powerkitButtonsTotalBox.find( '.pk-share-buttons-count' ).html( response.total_count ); powerkitButtonsTotalBox.show().removeClass( 'pk-share-buttons-total-no-count' ); } } } // Remove Loading Class. powerkitButtonsBox.removeClass( 'pk-share-buttons-loading' ); }, error: function() { // Remove Loading Class. powerkitButtonsBox.removeClass( 'pk-share-buttons-loading' ); } }); }); }); })(jQuery); </script> </body> </html>