433 matches found
CVE-2025-14172-Nuclei-Template
📄 CVE-2025-14172 用 Nuclei テンプレート 🚀 概要 このリポジトリは、WordPress プラグイン WP Page Permalink Extension における Missing Authorization Vulnerability（CVE-2025-14172） を検出するために特別に設計された Nuclei テンプレートを提供します。この問題により、認証済みの攻撃者が脆弱な AJAX アクションを介してサイトのリライトルールをリモートでフラッシュすることが可能になります。 🔍 脆弱性の説明 CVE-2025-14172 は、WordPress 用プラグイ...
CVE-2026-97272
Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...
CVE-2026-97272 WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...
CVE-2026-97272
The Premmerce Permalink Manager for WooCommerce plugin for WordPress versions
EUVD-2026-89922
Unauthenticated Cross Site Scripting XSS in Premmerce Permalink Manager for WooCommerce = 2.3.13 versions...
CVE-2026-92712
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
CVE-2026-92712 ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
CVE-2026-92712 ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
CVE-2026-92712
The ReactPress WordPress plugin (versions up to and including 3.4.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the permalink parameter. The root cause is insufficient input sanitization and output escaping; the application uses sanitize_url(), which fails to prevent the fetching of ...
EUVD-2026-89685
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...
CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...
CVE-2026-50190
Shaarli versions prior to 0.16.3 are vulnerable to stored XSS in the permalink handler of BookmarkListController.php, where raw bookmark titles are emitted unescaped into the document . An attacker who controls a remote page's title can have it fetched verbatim when an admin bookmarks the URL, pl...
EUVD-2026-63551
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...
CVE-2026-50190 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...
WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure
Description WordPress does not correctly filter post types in some cases when guessing a permalink, which could allow unauthenticated users to discover the slugs of content excluded from search...
WordPress Praison AI SEO plugin < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure) vulnerability
Unauthenticated Multiple Missing Authorization Post Permalink Modification, Plugin Settings Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Praison SEO WordPress versions 5.0.7...
CVE-2026-12082
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...
CVE-2026-12082 Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...
CVE-2026-12082
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...