DataPress (Dataverse Integration)
DataPress (Dataverse Integration) (datapress-dataverse-integration) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Aug 06, 2026; the highest published CVSS base score is 6.8.
datapress-dataverse-integrationCVE-2026-5336: DataPress permits Contributor-level disclosure of viewer data before 2.91
DataPress before 2.91 lets a Contributor create Twig-rendered content while exposing the viewing request's cookies through the Twig params and request.params objects. When a higher-privileged user views that content, attacker-controlled template expressions can read sensitive viewer cookies and may enable session compromise. Version 2.91 removes cookies from Twig request parameters by default. The exact editor field, shortcode or block, rendering endpoint, Twig expression and PHP rendering function are not disclosed.
| Safe version |
|
||
|---|---|---|---|
| Aug 06, 2026 |
CVE-2026-5336
DataPress permits Contributor-level disclosure of viewer data before 2.91
DataPress before 2.91 lets a Contributor create Twig-rendered content while exposing the viewing request's cookies through the Twig params and request.params objects. When a higher-privileged user views that content, attacker-controlled template expressions can read sensitive viewer cookies and may enable session compromise. Version 2.91 removes cookies from Twig request parameters by default. The exact editor field, shortcode or block, rendering endpoint, Twig expression and PHP rendering function are not disclosed.
|
2.91 |
CVE6.8
|