CVE-2026-17025

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-16776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18558

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14379

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-14877

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-107323

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing...

CVE-2026-14882

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104742

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-104741

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-104762

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-104725

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...

CVE-2026-103520

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

CVE-2026-104023

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-104723

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

caOptics

नोट विकास की प्राथमिकताओं में बदलाव और अपने सामुदायिक प्रयासों को अन्य क्षेत्रों PoCs, अन्य टूल और डेमो/प्रस्तुतियाँ पर केंद्रित करने के कारण प्रोजेक्ट संग्रहीत कर दिया गया है; प्रोजेक्ट को केवल-पठनीय read-only बना दिया गया है। CA Optics - Azure AD Conditional Access Gap Analyzer कंडीशनल एक्सेस...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

CVE-2024-28987

CVE-2024-28987 Exploit de Prova de Conceito para CVE-2024-28987: Vulnerabilidade de Credencial Codificada do SolarWinds Web Help Desk Visão Geral Extrai até 25 tickets mais recentes limitação da API Obtém detalhes completos de cada ticket Analisa IDs de tickets para estimar o total de tickets no...

CVE-2024-48208

CVE-2024-48208 O repositório contém todo o trabalho relacionado ao desenvolvimento do PoC para demonstrar como uma simples leitura OOB Out-of-Bound pode resultar em fugas de jail e quebra de controle de acesso. Sobre a Vulnerabilidade A descrição original do CVE é a seguinte: O PR no GitHub no...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Sumário Executivo Este relatório detalha duas vulnerabilidades críticas de segurança descobertas no pacote feiskyer/mcp-kubernetes-server. Quando implantado, o servidor expõe uma ferramenta MCP chamada kubectl, que se destina a fornecer acesso...