CLSA-2026-1792160970 TuxCare security update for @babel/plugin-transform-object-assign (1 CVE)

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792160967 TuxCare security update for @babel/plugin-proposal-numeric-separator (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792160966 TuxCare security update for @babel/plugin-proposal-nullish-coalescing-operator (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-nullish-coalescing-operator to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by azqzazq1 in WordPress Plugin Passster versions = 4.3.18...

CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

CVE-2026-3844

╔════════════════════════════════════════════════════════════╗ ║ CVE-2026-3844 ║ ║ Breeze Cache = 2.4.4 Arbitrary File Upload ║ ║ Unauthenticated RCE | Authorized Lab Use Only ║ ╚════════════════════════════════════════════════════════════╝ Overview CVE-2026-3844 is an arbitrary file upload...

CVE-2026-109930

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

CVE-2024-37051

CVE-2024-37051 Analysis Overview CVE-2024-37051 is a vulnerability found in JetBrains' IntelliJ-based IDEs, affecting the GitHub plugin. It allows unauthorized exposure of GitHub access tokens when a malicious pull request PR is loaded. Technical Details The vulnerability occurs during the...

wp2shell-compromise-scanner-plugin

Compromise Scanner for wp2shell read-only A standalone, read-only WordPress plugin that scans your database and plugin directory for signs that the wp2shell core chain CVE-2026-63030 + CVE-2026-60137 was exploited — even if it happened weeks ago or the attacker cleaned up. It changes nothing on...

CVE-2024-28000

CVE-2024-28000 - LiteSpeed Cache Privilege Escalation PoC !WARNING This repository is intended for educational and research purposes only. Use the provided PoC exclusively on systems you own or have explicit permission to test. Unauthorized access , exploitation, or misuse of any material in this...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

CVE-2026-107648

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.5 . The root cause is insufficient input sanitization and output escaping within several parameters, including action, function, plugin, p...

EUVD-2026-102838

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives,...

CVE-2026-110029

The Squeeze WordPress plugin (versions before 1.8.1 ) is vulnerable to an authorization bypass due to a missing capability check on an AJAX action . This flaw allows authenticated users with Subscriber privileges or higher to revert any attachment to its backup copy. Furthermore, attackers can pe...

CVE-2026-109930

The MAIO WordPress plugin (versions before 7.3.22 ) contains a vulnerability where it fails to properly restrict access to its analytics data. The software treats a hardcoded credential shipped verbatim in its public source as a valid API key. This flaw allows unauthenticated attackers to retriev...

CVE-2026-109930 MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Peter Tang in WordPress Plugin Login with phone number versions = 1.8.77...

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin 2Way VideoCalls and Random Chat versions = 6.1.5...

EUVD-2026-102823

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

WordPress Events Made Easy plugin <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin Events Made Easy versions = 3.2.22...