CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenverse versions = 4.0.2...

CVE-2026-19943

The Gutenverse WordPress plugin (a page builder and site editor) is vulnerable to Stored Cross-Site Scripting via the titleTag block attribute in all versions up to and including 4.0.2 . The root cause is insufficient input sanitization and output escaping : the malicious titleTag value survives ...

EUVD-2026-65279

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...

CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65276

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65274

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75930

FundEngine – Donation and Crowdfunding Platform for WordPress (all versions up to and including 1.8.1 ) suffers from an authorization bypass due to missing authorization verification. An authenticated attacker with subscriber-level access or above can modify arbitrary posts and pages — overwritin...

CVE-2024-40445_CVE-2024-40446

مرجع ثغرات MimeTeX CVE-2024-40445 وCVE-2024-40446 يعد هذا المستودع المرجع العام للمشكلات الأمنية CVE-2024-40445 وCVE-2024-40446 التي تؤثر على MimeTeX، وهو مُصيّر LaTeX مفتوح المصدر وخفيف الوزن مكتوب بلغة C. ⚠️ يبدو أن MimeTeX لم يعد مدعومًا بشكل نشط. يُنصح المستخدمون والمطورون بشدة بتقييم المخاطر...

CVE-2026-75982

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

sudo-snooper

sudo-snooper sudo-snooper acts like the original sudo binary to fool users into entering their passwords. It will show a fake prompt just like the original to the user to enter their sudo password. This can be useful in penetration tests or security evaluations for testing user knowledge...

CVE-2018-18441-exploit

CVE-2018-18441-exploit root@kitploit: Les caméras Wi-Fi de la série DCS de D-Link exposent des informations sensibles concernant la configuration de l'appareil. Les appareils concernés incluent de nombreux modèles de la série DCS, tels que : DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L,...

CVE-2022-37706-LPE-exploit

CVE-2022-37706 皆さん、今回は私が発見した最近の0-dayについてお話しします。Linuxの主要なウィンドウマネージャの一つであるEnlightenment https://www.enlightenment.org/ に関するものです。 この0-dayは、任意のユーザーを非常に簡単かつ即座にroot権限に昇格させます。 このエクスプロイトはUbuntu 22.04でテストされていますが、どのディストリビューションでも問題なく動作するはずです。...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 ثغرة استخراج بيانات غير مصادق عليها في طابعات Kyocera، تسمح باستعادة كلمات المرور النصية الصريحة cleartext لدفتر العناوين والمجال المرتبط بالمجال. نظرة عامة على الثغرة في عام 2021 أثناء اختبار اختراق pen test، كنت أتلاعب بتطبيق العميل السميك thick client الخاص بشركة Kyocera...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: غياب المصادقة على /api/v1/full-spec يكشف مخطط OpenAPI الكامل المنتج: dgtlmoon/changedetection.io — v0.55.7 الملف: changedetectionio/api/Spec.py CWE: CWE-306 — فقدان المصادقة لوظيفة حرجة CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 متوسط CNA: Turan...

CVE-2025-54962

🔥 CVE-2025-54962 — Téléchargement de fichier non sécurisé dans le serveur web OpenPLC Runtime OpenPLC Runtime ≤ 2024-12-31 — XSS stocké, CSRF 📌 Résumé J'ai découvert une vulnérabilité dans le serveur web OpenPLC Runtime version publiée : 2024-12-31 qui permet aux utilisateurs authentifiés de...

the-backdoor-factory

The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF For security professionals and researchers only. The goal of BDF is to patch executable binaries with user...

CVE-2025-26326

CVE-2025-26326 ثغرة أمنية حرجة في إضافتي الاتصال عن بُعد NVDA Remote وTele NVDA Remote. تم تسجيل هذه الثغرة الأمنية تحت المعرف CVE-2025-26326 في CNA MITRE. تم نشر هذه الثغرة/الـ CVE في قواعد البيانات العالمية التالية: NVD، المعهد الوطني للمعايير والتكنولوجيا .gov Vulners.com tenable.com Debricked...