CVE-2026-93755

The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyformsgetclientip function reading raw HTTPCLIENTIP and HTTPXFORWARDEDFOR request headers without any validation or...

CVE-2026-93755 Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header

The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyformsgetclientip function reading raw HTTPCLIENTIP and HTTPXFORWARDEDFOR request headers without any validation or...

EUVD-2026-119136

The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyformsgetclientip function reading raw HTTPCLIENTIP and HTTPXFORWARDEDFOR request headers without any validation or...

CVE-2026-93755

The Happyforms Pro plugin for WordPress (versions up to and including 1.38.9 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is the happyforms_get_client_ip() function, which reads raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR request headers without sufficient...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

The pH7Builder (pH7 Social Dating CMS) through version 18.2.0 is vulnerable to an IP-based throttling bypass. The application resolves client IP addresses in _protected/framework/Ip/Ip.class.php using the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying if the request originates ...

CVE-2026-18579: Improper Neutralization of Input During Web Page Generation

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-22201: Use of Less Trusted Source

wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTPCLIENTIP or HTTPXFORWARDEDFOR headers to spoof their IP address and circumvent...

Titan Anti-spam & Security < 7.3.1 - Protection Bypass due to IP Spoofing

The plugin does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers. The function wantispampgetip is vulnerable to IP spoofing because of the general usage of $SERVER'HTTPXFORWARDEDFOR' curl -i -H...

uListing < 1.7 - Unauthenticated SQL Injections

The /1/api/ulisting-page-statistics/listing REST route did not sanitise or escape the listingid and userid GET parameters before using them in a SQL statement, leading to an SQL Injection issue. The plugin also did not sanitise and escape the HTTPCLIENTIP and HTTPXFORWARDEDFOR which are then used...

CVE-2015-9466

The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTPCLIENTIP, HTTPXFORWARDEDFOR, HTTPXFORWARDED, HTTPFORWARDEDFOR, or HTTPFORWARDED variable...

CVE-2015-9466: Improper Neutralization of Special Elements used in an SQL Command

The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTPCLIENTIP, HTTPXFORWARDEDFOR, HTTPXFORWARDED, HTTPFORWARDEDFOR, or HTTPFORWARDED variable...

mystats (hits.php) Multiple Vulnerabilities exploit

No description provided by source. myStats hits.php Multiple Remote Vulnerabilities Exploit url: http://mywebland.com/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk...

WordPress Plugin Comment Rating 2.9.32 - Multiple Vulnerabilities

Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link: http://wealthynetizen.com/wordpress-plugin-comment-rating/ Version: 2.9.32 Tested on: Fedora 18 + mys...

Wordpress Comment Rating Plugin 2.9.32 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress plugin: Comment Rating SQL injection Google Dork: Date: 21/02/2013 Exploit Author: ebanyu Url Author: www.ebanyu.com.ar Vendor Homepage: wealthynetizen.com Software Link:...

Nuclear-Blog v4. 0 message Board XSS vulnerability-vulnerability warning-the black bar safety net

In fact, this vulnerability, at the time the release of the Nuclear-Blog v4. 0 Source Code the day it was discovered, found that people are t00ls a core, and then I directly up, but the network disk download is still not up, so the current market for all Nuclear-Blog v4. 0 are the presence of thi...

BlueCMS getip()injection vulnerability-vulnerability warning-the black bar safety net

, Description,BlueCMS is a place to classified information portal dedicated CMS system. Procedures in using the getipfunction to get the Client ip when not strictly filter the data, resulting in sql injection vulnerability. Second, the analysis //comment.php $sql = "INSERT INTO ". table'comment'....

BBSGood Forum program moprepost. asp variable HTTP_X_FORWARDED_FOR injection vulnerability-vulnerability warning-the black bar safety net

BBSGOOD is domestic first using the cache technology Forum, BBSGOOD posts and list home can generate a static HTML file. In the file moprepost. asp: if Request. ServerVariables"HTTPXFORWARDEDFOR"="" then ipdress=Request. ServerVariables"REMOTEADDR" else ipdress=Request...

BBSGood论坛程序moprepost.asp 变量HTTP_X_FORWARDED_FOR注入漏洞

BBSGOOD是国内首创使用缓存技术的论坛，BBSGOOD的帖子和列表首页是可以生成静态HTML文件的。 在文件moprepost.asp中： if Request.ServerVariables"HTTPXFORWARDEDFOR"="" then ipdress=Request.ServerVariables"REMOTEADDR" else ipdress=Request.ServerVariables"HTTPXFORWARDEDFOR" end if //第351行 …… sql="insert into LxTelTopic...

Joomla Module Camp26 Visitor Data 1.1 Remote code Execution

No description provided by source. Joomla Module Camp26 Visitor Data 1.1 Remote code Execution ============================================================ - Discovered by : Chip D3 Bi0s - Email : [email protected] - Date : 2010-04-28 - Severity : 9/10 CVSS scored -----------------------------...