community-scripts

Scripts de la comunidad Una colección de scripts de ZAP proporcionados por la comunidad, es decir, por vosotros : La forma más sencilla de usar este repositorio en ZAP es instalar el add-on 'Community Scripts' desde ZAP Marketplace. !CAUTION Aunque revisamos todos los scripts para asegurarnos de...

Addon

ClearURLs ClearURLs 是一款基于新 WebExtensions 技术的附加组件，针对 Firefox 及部分基于 Chrome 的浏览器进行了优化。 此扩展程序会自动从 URL 中移除跟踪元素，以帮助您在浏览互联网时保护隐私。跟踪规则由我们定期更新，可在此处找到：此处。 应用场景 许多网站在 URL 中使用跟踪元素（例如 https://example.com?utmsource=newsletter1&utmmedium=email&utmcampaign=sale）来标记您的在线活动。所有这些跟踪代码对于网站正常显示或运行并非必需，因此可以被移除——这正是...

CVE-2026-94675

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack = 6.2.13 versions...

CVE-2026-94675 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack = 6.2.13 versions...

EUVD-2026-93065

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack = 6.2.13 versions...

CVE-2026-94675

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions

CVE-2026-94669

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13...

CVE-2026-94669 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13...

CVE-2026-94669 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13...

EUVD-2026-92391

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13...

CVE-2026-94669

The Fluent Forms Pro Add On Pack plugin by WP ManageNinja LLC, versions up to and including 6.2.13 , is vulnerable to a Broken Access Control issue (CWE-862). The root cause is missing authorization which allows for the exploitation of incorrectly configured access control security levels . This ...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.13...

CVE-2026-15897

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Privilege Escalation . The flaw exists in the Register & Login add-on's before_email_success_msg() function, which fails to perform ownership or capability checks when proc...

EUVD-2026-91176

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's beforeemailsuccessmsg function, in its registerloginaction='update' flow, trusting an attacker-supplied...

CVE-2026-15989

The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316 ) is vulnerable to unauthenticated privilege escalation . The root cause lies in the Register & Login add-on's before_email_success_msg() function, which whitelists the client-submitted role key ...

CVE-2026-85010

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero...

Astra Linux – Vulnerability in Firefox and Thunderbird

The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the...

EUVD-2026-76794

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

GHSA-VV4J-M4VR-F3G6 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...