Ja4Scanner

Ja4Scanner — Bug Bounty Hunter's Toolkit A Python CLI tool fo...

WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin VK All in One Expansion Unit versions = 9.113.3...

CVE-2026-32409: Missing Authorization

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through = 1.50.2...

commix

Automated All-in-One OS Command Injection Exploitation Tool...

puput (2.0.0), wagtail-all-in-one-accessibility (>=1.1.0, <=1.8.0) +4 more potentially affected by CVE-2026-28222 via wagtail (5.0.5)

wagtail PYPI version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - puput 2.0.0 - wagtail-all-in-one-accessibility =1.1.0, =5.0.0, =3.10.1, =0.0.1, =0.0.2 Source cves: CVE-2026-28222 Source advisory:...

aratinga (0.1.0a0.dev3), coop (7.1.0) +5 more potentially affected by CVE-2026-28222 via wagtail (>=7.1.0, <=7.1.3)

wagtail PYPI version =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.1.0b0 Source cves: CVE-2026-28222 Source advisory: OSV:PYSEC-2026-2307...

aratinga (0.1.0a0.dev3), coop (7.1.0) +5 more potentially affected by CVE-2026-28223 via wagtail (>=7.1.0, <=7.1.3)

wagtail PYPI version =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.1.0b0 Source cves: CVE-2026-28223 Source advisory: OSV:PYSEC-2026-2308...

CVE-2026-28110

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through =...

CVE-2026-1706: Improper Neutralization of Input During Web Page Generation

The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

aratinga (0.1.0a0.dev3), coop (7.1.0) +5 more potentially affected by CVE-2026-28222 via wagtail (>=7.1.0, <=7.1.3)

wagtail PYPI version =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.1.0b0 Source cves: CVE-2026-28222 Source advisory: OSV:GHSA-P5CM-246W-84JM...

EUVD-2026-9274

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators...

WordPress plugin: All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2026-2628: Authentication Bypass Using an Alternate Path or Channel

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators...

PT-2026-22714

Name of the Vulnerable Software and Affected Versions The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress versions through 2.2.5 Description The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is susceptible to an authentication bypass,...

CVE-2025-53217

Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through = 2.0.2...

CVE-2025-53217 WordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through = 2.0.2...

CVE-2025-53217 WordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through = 2.0.2...

CVE-2025-53217

The CVE-2025-53217 entry concerns the WordPress plugin AIO WP Builder (staviravn all-in-one-wp-builder) with versions up to and including 2.0.2, where a Missing Authorization vulnerability allows exploitation of incorrectly configured access control. The root cause is broken access control in the...

CVE-2025-53217: Missing Authorization

Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through = 2.0.2...

CVE-2026-2019

The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insufficient input validation on the 'Assign page' field which is passed directly to the eval function. This makes it possible for authenticated...