CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: обход 2FA через привязанную к сессии блокировку OTP Обход аутентификации в плагине miniOrange Two-Factor Authentication для WordPress позволяет злоумышленнику, уже владеющему действующим паролем жертвы, неограниченно перебирать второй фактор, полностью...

CVE-2026-104854 Nx daemon and plugin worker sockets are accessible to other local users

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on ...

CVE-2023-4634

CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library Plugin 3.10 CVE-2023-4634 Info Patrowl discovered An unauthenticated RCE Vulnerability on Media-Librairy-Assistant Wordpress Plugin in version 3.10. The exploit is not trivial and requires just a little setup explained bellow. Global...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...

WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mindio Magic MCP versions = 0.5.6...

WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WebSamurai versions = 1.0.7...

WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart One Click Setup – Complete Demo Import & Export versions = 1.4.3...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

WordPress CMP – Coming Soon & Maintenance plugin < 4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability

Unauthenticated Maintenance Mode Bypass vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.20...

CVE-2026-3844

╔════════════════════════════════════════════════════════════╗ ║ CVE-2026-3844 ║ ║ Breeze Cache = 2.4.4 Arbitrary File Upload ║ ║ Unauthenticated RCE | Authorized Lab Use Only ║ ╚════════════════════════════════════════════════════════════╝ Overview CVE-2026-3844 is an arbitrary file upload...

CVE-2024-37051

CVE-2024-37051 Analysis Overview CVE-2024-37051 is a vulnerability found in JetBrains' IntelliJ-based IDEs, affecting the GitHub plugin. It allows unauthorized exposure of GitHub access tokens when a malicious pull request PR is loaded. Technical Details The vulnerability occurs during the...

wp2shell-compromise-scanner-plugin

Compromise Scanner for wp2shell read-only A standalone, read-only WordPress plugin that scans your database and plugin directory for signs that the wp2shell core chain CVE-2026-63030 + CVE-2026-60137 was exploited — even if it happened weeks ago or the attacker cleaned up. It changes nothing on...

CVE-2024-28000

CVE-2024-28000 - LiteSpeed Cache Privilege Escalation PoC !WARNING This repository is intended for educational and research purposes only. Use the provided PoC exclusively on systems you own or have explicit permission to test. Unauthorized access , exploitation, or misuse of any material in this...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

CVE-2026-85492

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

EUVD-2026-91336

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492

The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...