CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

CVE-2026-2002-poc

Resumen El complemento Forminator Forms – Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro formname en todas las versiones hasta la 1.50.2 inclusive, debido a una sanitización insuficiente de entrada y escape de...

EUVD-2026-91904

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Exigimos el regreso seguro de todos los ciudadanos que han sido tomados como rehenes por el grupo terrorista Hamás. No descansaremos hasta que cada rehén sea liberado y regrese a casa sano y salvo. Puedes ayudar a traerlos de vuelta a...

CVE-2026-97641

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

EUVD-2026-91254

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91249

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-97641

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.28.3 . The root cause is insufficient input sanitization and output escaping within the Comment Content feature. This flaw allows unauthenticated attacker...

EUVD-2026-91244

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-95817

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.0 . The root cause is insufficient input sanitization and output escaping within the Comment Content functionality. This allows unauthenticated attackers to in...

CVE-2026-97336 CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-102772

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.13.1 . The root cause is insufficient input sanitization and output escaping within the parameter (e.g., kl_code, kl_post_code). This flaw allows unauthenticated attackers to in...

EUVD-2026-91241

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-102772 CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...