CVE-2024-3105-PoC

CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

misp-dashboard

misp-dashboard 一个实时展示来自一个或多个MISP实例的ZMQ源数据和统计信息的仪表板。 该仪表板可作为实时态势感知工具，用于收集威胁情报信息。 misp-dashboard 包含一个游戏化工具，用于展示每个组织的贡献以及它们随时间的排名变化。 该仪表板可用于安全运营中心（SOC）、安全团队或在网络演习期间，跟踪您各个MISP实例上正在处理的内容。 功能 实时仪表板 支持订阅来自不同MISP实例的多个ZMQ源 实时显示组织的最新贡献 展示可解析的实时发布地理位置 地理位置仪表板 提供历史地理位置信息，帮助安全团队、CSIRT或SOC在其管辖范围内发现威胁...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia para WordPress, BuddyPress y bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

CVE-2024-6132

CVE-2024-6132 Pexels: Fotos de stock gratuitas = 1.2.2 - Carga arbitraria de archivos autenticada Contribuidor+ Uso usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY NXPLOIT -...

CVE-2026-92767

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92767 Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-91967

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92767

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.0.5 . The root cause is insufficient input sanitization and output escaping within the 'offset' Shortcode Attribute . This allows authenticated attackers with ...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-15795

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-91961

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...

EUVD-2026-91955

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...