Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)

Last week, there were 501 vulnerabilities disclosed in 367 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 201 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

CVE-2022-1388-rs

CVE-2022-1388-rs ماسح ضوئي وقشرة تفاعلية لثغرة CVE-2022-1388 في F5 BIG-IP iControl REST لتجاوز المصادقة وتنفيذ الأوامر عن بُعد، مكتوب بلغة Rust ملخص للتلخيص، فيما يلي نظرة عامة على الشروط اللازمة لطلب استغلال هذه الثغرة: يجب أن يتضمن ترويسة Connection القيمة X-F5-Auth-Token يجب أن تكون ترويسة...

wp2shell-scan

wp2shell-scan CVE-2026-63030 wp2shell के लिए एक स्कैनर और प्रूफ-ऑफ-कॉन्सेप्ट टूलकिट, जो WordPress कोर में एक प्री-ऑथेंटिकेटेड रिमोट कोड निष्पादन भेद्यता है विशेषताएँ दो गैर-विनाशकारी पता लगाने के तरीके: --check-type time-based SLEEP टाइमिंग और --check-type error-based TRUE/FALSE/टूटा डिफरेंशियल।...

CVE-2022-1388_PoC

استغلال RCE في F5 BIG-IP CVE-2022-1388 POST 1: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " سطر أوامر curl: $ curl -i -s -k -X $'POST' \ -H $'Host: :8443' \ -H...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

Apache Submarine 0.8.0 Authentication Bypass / Remote Code Execution

Summary Apache Submarine Submarine for short is an End-to-End Machine Learning Platform to allow data scientists to create end-to-end machine learning workflows. On Submarine, data scientists can finish each stage in the ML model lifecycle, including data exploration, data pipeline creation, mode...

...[ More ]

Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...

CVE-2022-1388-POC

CVE-2022-1388 Poc PsychoSec द्वारा CVE-2022-1388 के लिए बेहतर POC जो कई F5 उत्पादों को प्रभावित करता है। यह Horizon3 के CVE-2022-1388 के लिए Proof of Concept का बेहतर संस्करण है: https://github.com/horizon3ai/CVE-2022-1388 इस संस्करण में कई सुधारों के साथ-साथ दूरस्थ कमांड चलाने के लिए एक इंटरैक्ट...

CVE-2026-41729

CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC यह रिपॉजिटरी एक आधिकारिक Spring सुरक्षा सलाहकार के रूप में प्रकट CVE-2026-41729 का न्यूनतम पुनरुत्पादन PoC है। आधिकारिक सलाहकार: https://spring.io/security/cve-2026-41729/ आधिकारिक शीर्षक: Spring Data REST SpEL Injection via M...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

wp2shell-PoC

wp2shell-PoC ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Overview Proof-of-concept for the wp2shell vulnerability chain affecting WordPress Core, combining CVE-2026-63030 and CVE-2026-60137...

PT-2026-103667

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 — Flowise AI Account Takeover to RCE !Python...

Exploit for CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploite...

F5 BIG-IP iControl - REST Auth Bypass RCE

F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication. id: CVE-2022-1388 info: name: F5 BIG-IP...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)

Last week, there were 362 vulnerabilities disclosed in 247 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 186 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Exploit for CVE-2026-89274

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

Security Bulletin: IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Cognos Analytics application versions 12.0.4 and 12.1.3. This Security Bulletin addresses the affected versions and the rememdiation fixes. Please note that certain CVEs are applicable only for versi...