CVE-2026-3844

╔════════════════════════════════════════════════════════════╗ ║ CVE-2026-3844 ║ ║ Breeze Cache = 2.4.4 Arbitrary File Upload ║ ║ Unauthenticated RCE | Authorized Lab Use Only ║ ╚════════════════════════════════════════════════════════════╝ Overview CVE-2026-3844 is an arbitrary file upload...

CVE-2026-109930

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

CVE-2024-37051

CVE-2024-37051 Analysis Overview CVE-2024-37051 is a vulnerability found in JetBrains' IntelliJ-based IDEs, affecting the GitHub plugin. It allows unauthorized exposure of GitHub access tokens when a malicious pull request PR is loaded. Technical Details The vulnerability occurs during the...

wp2shell-compromise-scanner-plugin

Compromise Scanner for wp2shell read-only A standalone, read-only WordPress plugin that scans your database and plugin directory for signs that the wp2shell core chain CVE-2026-63030 + CVE-2026-60137 was exploited — even if it happened weeks ago or the attacker cleaned up. It changes nothing on...

CVE-2024-28000

CVE-2024-28000 - LiteSpeed Cache Privilege Escalation PoC !WARNING This repository is intended for educational and research purposes only. Use the provided PoC exclusively on systems you own or have explicit permission to test. Unauthorized access , exploitation, or misuse of any material in this...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

CVE-2026-107648

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.5 . The root cause is insufficient input sanitization and output escaping within several parameters, including action, function, plugin, p...

CVE-2026-110029

The Squeeze WordPress plugin (versions before 1.8.1 ) is vulnerable to an authorization bypass due to a missing capability check on an AJAX action . This flaw allows authenticated users with Subscriber privileges or higher to revert any attachment to its backup copy. Furthermore, attackers can pe...

EUVD-2026-102838

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives,...

CVE-2026-109930 MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

CVE-2026-109930

The MAIO WordPress plugin (versions before 7.3.22 ) contains a vulnerability where it fails to properly restrict access to its analytics data. The software treats a hardcoded credential shipped verbatim in its public source as a valid API key. This flaw allows unauthenticated attackers to retriev...

WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Peter Tang in WordPress Plugin Login with phone number versions = 1.8.77...

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin 2Way VideoCalls and Random Chat versions = 6.1.5...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...

EUVD-2026-102823

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

WordPress Events Made Easy plugin <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin Events Made Easy versions = 3.2.22...

WordPress Social Share Buttons plugin <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by chimerascope in WordPress Plugin Social Share Buttons versions = 1.30...

WordPress Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin <= 3.7.4 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free Unauthenticated Stored Blind XSS Executive Summary This repository contains a local Docker lab for reproducing CVE-2025-11262 , an unauthenticated stored cross-site scripting issue affecting the WordPress plugin Link Whisper Free. The lab compares two plugin...