CVE-2026-85492

The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...

CVE-2026-13158

CVE-2026-13158：Everest Toolkit 快速链接： 在 DEV.to 文章 上阅读完整的深度技术公告，或浏览研究员的官方网络安全作品集。 📌 执行摘要与技术元数据 参数| 技术规格 ---|--- 漏洞标识符| CVE-2026-13158 目标软件| Everest Toolkit（WordPress 插件） 插件 Slug| everest-toolkit 受影响版本| = 1.2.3 漏洞类型| 危险类型文件的不受限制上传（CWE-434 / OWASP A03） CVSS v3.1 评分| 6.6（中危）...

CVE-2026-96578

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2025-11262-Lab

CVE-2025-11262 - Link Whisper Free 未认证存储型盲 XSS 执行摘要 此仓库包含一个本地 Docker 实验环境，用于复现 CVE-2025-11262 ，这是一个影响 WordPress 插件 Link Whisper Free 的未认证存储型跨站脚本漏洞。 该实验环境对比两个插件版本： Service| Plugin version| Purpose| URL ---|---|---|--- vuln| 0.9.0| 易受攻击的目标| http://127.0.0.1:8081 patched| 0.9.1| 已修补的对比目标|...

CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

EUVD-2026-91247

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-96578

The GSpeech TTS – WordPress Text To Speech Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.22.0 . The root cause is insufficient input sanitization and output escaping within the Comment Content functionality. Specifically, an mXSS-sty...

CVE-2026-96578 GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96578 GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-91238

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-2473

CVE-2024-2473 — WPS Hide Login Page Identifier A professional Python scanner to detect Login Page Disclosure in WordPress sites running WPS Hide Login ≤ 1.9.15.2 Coded byVenexy Table of Contents Overview Vulnerability Details How It Works Requirements Installation Usage Output Example Disclaimer...

CVE-2026-97219

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-84740

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-90952

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

r2d2

r2d2 用于 radare2 的 GPT-4 插件 简介 这是一个 radare2 插件，利用 GPT-4 让 GPT-4 直接发布 r2 命令并解释输出结果。 https://github.com/dnakov/r2d2/assets/3777433/4bc7b211-bccc-4b04-9350-6bfca8989edb https://github.com/dnakov/r2d2/assets/3777433/5bcc8e20-dda0-48ac-94e5-e0c8c44a0912 安装 从源码安装...

CVE-2026-97219

The MStore API WordPress plugin before version 4.22.1 is vulnerable to a payment bypass due to a lack of restriction on which fields of an order a customer can update. This allows any authenticated user with a self-registerable account to modify the status of their own unpaid orders to a paid or ...

EUVD-2026-91216

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...