EUVD-2026-96200

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16...

CVE-2026-93927

The Axiomthemes Veto WordPress theme (versions

CVE-2026-93929

The ThemeREX Group Travesia WordPress theme is vulnerable to a PHP Object Injection flaw in versions 1.1.16 and below . This vulnerability arises from the deserialization of untrusted data , which may allow an attacker to inject objects into the application. The impact is rated as CRITICAL with a...

CVE-2026-106606 WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0...

CVE-2026-106606

The YITH WooCommerce Affiliates WordPress plugin (versions

EUVD-2026-96204

Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0...

CVE-2022-36804-MASS-RCE

CVE-2022-36804-POC Una vulnerabilidad crítica CVE-2022-36804 en Atlassian Bitbucket Server y Data Center podría ser explotada por atacantes no autorizados para ejecutar código malicioso en instancias vulnerables. versiones afectadas Todas las versiones de Bitbucket Server y Data Center lanzadas...

CVE-2026-15178 Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-15178

The Fluent Forms plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 6.2.5 . The root cause is the plugin's failure to properly verify if a user is authorized to perform specific actions. This flaw allows authenticated attackers with Custom-level acce...

LockBit-Tattoo

LockBit-Tattoo Electronic: ID: 272784 Iscritto: Jul 20, 2022 Maschio: BTC: 3HeNJmgecLNHEhVn3JMcboybTgiFx4DGe3 Media: photo2022-09-0822-15-38.jpg Femmina: BTC: 3HC5eCcYtW27jhD59mg4U3haWr36teiLXB Media: photo2022-09-1101-07-49.jpg photo2022-09-1101-07-54.jpg DegB2W: ID: 272203 Iscritto: Jul 16, 202...

CVE-2026-91862

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-14877

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-105995

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

CVE-2026-105990

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...

CVE-2026-104023

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-96125

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

cyberchef-recipes

CyberChef is the self-purported 'Cyber Swiss-Army Knife' created by GCHQ. It's a fantastic tool for data transformation, extraction & manipulation in your web-browser. Full credit to @GCHQ for producing the tool. See: https://gchq.github.io/CyberChef/ General Tips Download CyberChef and run it...

CVE-2025-55182

¿Qué es CVE-2025-55182? También conocido como React2Shell, es una vulnerabilidad causada por un defecto estructural en React Server Components que, al deserializar datos, produce una contaminación de prototipo prototype pollution permitiendo ejecutar RCE. Las versiones afectadas son: React 19.0.0...

CVE-2026-103912 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103912

The JetFormBuilder WordPress plugin (versions 3.6.6 and below ) is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the parameter. Unauthenticated attackers can inject arbitrary web scripts by tricking ...