CVE-2026-8181

CVE-2026-8181 - Обход аутентификации в Burst Statistics CVSS 9.8 Критический — Обход аутентификации с захватом учётной записи администратора Описание CVE-2026-8181 — это уязвимость обхода аутентификации Authentication Bypass в плагине WordPress Burst Statistics версий с 3.4.0 по 3.4.1.1. Плагин...

EUVD-2026-91336

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492

The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Произвольная загрузка файлов с правами Admin+, приводящая к удалённому выполнению кода RCE 📖 Обзор бюллетеня безопасности CVE-2026-13158 — аутентифицированная уязвимость произвольной загрузки файлов с правами Admin+, затрагивающая плагин Everest Toolkit д...

CVE-2026-96578

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free: неаутентифицированный сохранённый слепой XSS Краткое описание Этот репозиторий содержит локальный Docker-стенд для воспроизведения CVE-2025-11262 — проблемы неаутентифицированного сохранённого межсайтового скриптинга stored XSS, затрагивающей плагин WordPress...

CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

EUVD-2026-91247

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-96578

The GSpeech TTS – WordPress Text To Speech Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.22.0 . The root cause is insufficient input sanitization and output escaping within the Comment Content functionality. Specifically, an mXSS-sty...

CVE-2026-96578 GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96578 GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-91238

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-2473

CVE-2024-2473 — Обнаружение скрытой страницы входа WPS Hide Login Профессиональный сканер на Python для обнаружения раскрытия страницы входа на сайтах WordPress с WPS Hide Login ≤ 1.9.15.2 НаписанVenexy Содержание Обзор Сведения об уязвимости Как это работает Требования Установка Использование...

CVE-2026-97219

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-84740

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

r2d2

r2d2 Плагин GPT-4 для radare2 Введение Это плагин для radare2, использующий GPT-4, чтобы GPT-4 мог выполнять команды r2 и интерпретировать их вывод. https://github.com/dnakov/r2d2/assets/3777433/4bc7b211-bccc-4b04-9350-6bfca8989edb...