WordPress Tripzzy plugin < 1.5.1 - Unauthenticated Arbitrary Comment Deletion vulnerability

Unauthenticated Arbitrary Comment Deletion vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Tripzzy Travel Engine System versions 1.5.1...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2023-45966

CVE-2023-45966 umputun/remark42 へのPOSTリクエスト内の悪意のあるJSONは、コメント作成リクエストにおける title フィールドの欠落と url フィールドの不十分なフィルタリングにより、ブラインドSSRFを引き起こします。 追加情報 コミット efceed6 で修正済み 脆弱性タイプ その他 CWE-918: Server Side Request Forgery 製品ベンダー https://github.com/umputun 影響を受ける製品コードベース 影響を受けるバージョン: umputun/remark42 = 1.12.1...

CVE-2019-9787

CVE-2019-9787 CSRF PoC 概要 CVE-2019-9787 CSRF の PoC WordPress バージョン 5.1.1 CVE-2019-9787 これはテスト目的以外では使用しないでください。 インストール root@kitploit: docker-compose up -d 攻撃 1. http://localhost:8080/wp-admin/install.php にアクセスし、WordPress をインストールします。WP 管理者アカウントを作成するだけで構いません。 2. 訪問者として...

CVE-2026-87839: Improper Access Control

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 W3 Total Cache CVE-2013-2010 上でのリモートコード実行 使い方: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" 出力: 対象: http://example.com + ペイロードが正常に送信されました。 + ターゲットでペイロードの実行を確認してください。 import requests import argparse def exploitrcetargeturl, payload: """Exploit t...

CVE-2009-4623

CVE-2009-4623 CVE-2009-4623 のリモートシェル: 非対話型シェルを取得し、高度な使用のために別のシェルを開きます !!! 使い方: CVE-2009-4623.sh hostnameandPath 例: CVE-2009-4623.sh http://192.168.1.24/advancedcommentsystem/admin.php オプション: -h このガラクタ...

CVE-2021-39473

CVE-2021-39473 影響を受ける製品コードベース HotelManager - v1.2 影響を受けるコンポーネント Kernel.php; Middleware 攻撃タイプ リモート 攻撃ベクトル この脆弱性を悪用するには、ユーザーは「rooms」「guests」「reservations」「users」を作成し、「comment」または「contact」フィールドに、バイパスを一切行わずにXSSペイロードを実行できる必要があります。 これは保存型XSSです。エンドポイント（rooms, guests,...

CVE-2026-13354

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-13354 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-83469

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-13354

The Asset CleanUp: Page Speed Booster WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via Comment Content in all versions up to and including 1.4.0.5 . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrar...

CVE-2026-13354 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-13354: Improper Neutralization of Input During Web Page Generation

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress WP Recipe Maker plugin <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability

Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin WP Recipe Maker versions = 10.8.1...

CVE-2026-18405

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18405 Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-82852

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18405 Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2.16 due to insufficient input sanitization and output escaping. This makes it...