All vulnerabilities
CWE-295
Medium
Content Egg — certificate validation skipped on affiliate feeds
| Vendor | keywordrush |
|---|---|
| Product | Content Egg |
| Weakness | CWE-295 |
| Reported | 2026-07-29 |
| Status | Vendor fixed |
The same weakness class as the AI Engine finding, in a second plugin: outbound requests to affiliate data feeds do not verify the server certificate. Held back from publication until the vendor ships a fixed build.
Related disclosures
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
Medium
Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload
Medium
Kirki Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
View all