PT-2026-116375

Name of the Vulnerable Software and Affected Versions Patreon WordPress versions prior to 1.10.0 Description The plugin fails to validate user-supplied redirect destinations before performing a redirection. This allows unauthenticated attackers to use a crafted link to redirect visitors to an...

PT-2026-116353

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.11 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

CLSA-2026-1792194447 TuxCare security update for @babel/plugin-transform-runtime (1 CVE)

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792194448 TuxCare security update for @babel/plugin-transform-runtime (1 CVE)

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792194449 TuxCare security update for @babel/plugin-transform-runtime (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-runtime to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792194450 TuxCare security update for @babel/plugin-transform-runtime (1 CVE)

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.11.5-tuxcare.1...

CLSA-2026-1792194433 TuxCare security update for @babel/plugin-transform-runtime (1 CVE)

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - Unauthenticated Stored Cross-Site Scripting Plugin URL https://wordpress.org/plugins/wp-stats/ Description Unauthenticated reflected XSS in the statsauthor GET parameter of statspage. The sanitization filter striptags is applied before urldecode, allowing an...

CVE-2025-47646

CVE-2025-47646 PoC Unauthenticated Privilege Escalation exploit for WordPress PSW Front-end Login Registration Plugin ≤ 1.12 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-47646 , targeting a vulnerability in the WordPress PSW Front-end Login Registration Plugin ≤...

CVE-2018-20463

CVE-2018-20463 There is a security vulnerability in WordPress JSmol2WP Plugin version 1.07. Attackers can exploit this vulnerability to read arbitrary files. Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file...

CVE-2026-78006-POC

CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar = 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution CONTACT telegram for any ask : @soldout0O 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20:...

CVE-2025-25101

🚀 CVE-2025-25101 - WordPress Munk Sites Plugin = 1.0.7 - CSRF to Arbitrary Plugin Installation 📌 Overview CVE-2025-25101 is a Cross-Site Request Forgery CSRF vulnerability in the MetricThemes Munk Sites plugin for WordPress versions ≤ 1.0.7. This vulnerability allows an unauthenticated attacker t...

grails-javamelody-sample-app

Grails Javamelody Sample App Grails sample application using the Javamelody plugin version 1.44 to illustrate the CVE-2013-4378 vulnerability...

CVE-2026-67413

A flaw was found in rabbitmq-server. An authenticated user with permissions to bind and publish messages can cause a Denial of Service DoS by submitting specially crafted pattern-matching expressions to the Java Message Service JMS topic exchange plugin. Because the message broker evaluates these...

CVE-2026-67230

A flaw was found in RabbitMQ. When the Web STOMP plugin is enabled, the WebSocket handler fails to enforce maximum frame size limits or login timeouts prior to client authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of small frames t...

CVE-2026-67223

A flaw was found in rabbitmq-server. When the service uses the Lightweight Directory Access Protocol LDAP authentication plugin with a configured user Distinguished Name DN pattern, it fails to properly escape special characters in the username. A remote attacker can exploit this vulnerability by...

CVE-2026-67222

A flaw was found in rabbitmq-server. An authenticated remote attacker with policymaker privileges can exploit this issue when the Shovel or Federation plugin is enabled by supplying a specially crafted authentication mechanism value. This causes the server to permanently exhaust Erlang virtual...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...

CVE-2025-6058

⚡ WPBookit = 1.0.4 - Unauthenticated Arbitrary File Upload 📝 Description The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function, which is hooked via the addbookingtype route in all versions up to, and...

jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1

Pipeline: Groovy Plugin Introduction A key component of the Pipeline plugin suite, this provides the standard execution engine for Pipeline steps, based on a custom Groovy interpreter that runs inside the Jenkins controller process. In principle other execution engines could be supported, with...