CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-120688

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPUSERAGENT demonstrated; more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to...

EUVD-2026-124975

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPUSERAGENT demonstrated; more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4439...

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-0924-different

Other Vulnerabilities Discovered During CVE-2025-0924 Analysis 01. Overview of Stored XSS and WordPress, WP Activity Log 1 Overview of Stored XSS and WordPress, WP Activity Log Stored XSS is a type of vulnerability where a malicious script is stored on the server and later automatically executed...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

rcno-reviews

Recencio Book Reviews A WordPress plugin for managing and displaying book reviews. Custom post type, 7 taxonomies, 13 shortcodes, 7 widgets, 6 templates, 5 extensions. All data stored in standard WordPress post meta — no custom tables. Background Recencio Book Reviews was created by Kemory Grubb...

CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs🚨🚨 Overview CVE-2024-52318 is a crosssite scripting XSS vulnerability in Apache Tomcat, which arises from improperly released resources in generated JavaServer Pages JSPs. This issue, introduced by a prior...

CVE-2026-105150 Product Filter for WooCommerce by WBW <= 3.4.5 - Reflected Cross-Site Scripting via 'text_no_products' Parameter

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'textnoproducts' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-124987

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoderproperties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance...

EUVD-2026-120397

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoderproperties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance...

CVE-2026-124987

A vulnerability exists in mikefarah yq versions up to 4.53.3 . The issue is located within the Encode function of the file pkg/yqlib/encoder_properties.go. Improper handling in this component leads to escaping of output , which can be exploited remotely . A pull request to address this issue has ...

CVE-2026-120683

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclienttestimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output...

CVE-2026-120509

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tproclientname' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping...

CVE-2026-111317

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-93429

The VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions up to and including 1.8.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'guests[][][documents]' parameter. This allows unaut...

EUVD-2026-119166

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note form field whose value is written to post meta note' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping...