All vulnerabilities
CWE-295
Medium
Content Egg — certificate validation skipped on affiliate feeds
| Vendor | keywordrush |
|---|---|
| Product | Content Egg |
| Weakness | CWE-295 |
| Reported | 2026-07-29 |
| Status | Vendor fixed |
The same weakness class as the AI Engine finding, in a second plugin: outbound requests to affiliate data feeds do not verify the server certificate. Held back from publication until the vendor ships a fixed build.
Related disclosures
High
Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Medium
Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
View all