CVE-2026-15004

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via image alt text in all versions up to and including 6.5.6 . The root cause is insufficient input sanitization and output escaping . An attacker with Author-leve...

EUVD-2026-82757

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-92714

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

EUVD-2026-82725

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

WordPress King Addons for Elementor plugin 51.1.56-51.1.80 - Author+ Missing Authorization vulnerability

Author+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin King Addons for Elementor versions 51.1.56-51.1.80...

CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...

EXPLOIT-CVE-2026-8832

CVE-2026-8832 のエクスプロイト WordPress プラグイン WPCode Lite Insert Headers and Footers v2.3.5 における リモートコード実行 RCE の脆弱性をテストするためのエクスプロイトツールです。この脆弱性は、カスタム投稿タイプ CPT wpcode をカスタム capabilitytype を定義せずに登録したことに起因します。この見落としにより、Author ロール 以上 のユーザーが XML-RPC を介してサーバー上で任意の PHP コードを実行できるようになります。 クレジット : t.me/FanatixLegi...

pafish

Pafish Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do. The project is free and open source; the code of all the anti-analysis techniques is publicly available. Pafish executables for...

WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API

Description WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit...

WP < 7.1.1 - Author+ Path Traversal via Templates REST API

Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

CVE-2026-78071

DPCalendar Free のロケーションタイトルを介した格納型XSS DPCalendar Free ≤ 10.11.2 — Authorロールのユーザーがコンテンツレビューを迂回し、ロケーションタイトルを介して永続的XSSを注入。任意の訪問者がホバーした際に発動 -orange 概要 $location-title フィールドは、defaultlocations.php 内で htmlspecialchars を使用せずにレンダリングされます。Joomla のサーバーサイド InputFilter::clean は文字列フィールドから と を除去しますが、...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.44 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by VuxNx in WordPress Plugin Photo Gallery by 10Web versions = 1.8.44...

WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Filebird versions = 6.5.6...

WordPress VK All in One Expansion Unit plugin <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kyokito, Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin VK All in One Expansion Unit versions = 9.118.0...

WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability

Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-87836

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-91011

EWWW Image Optimizer is a WordPress plugin that optimizes images on pages. Versions before 8.7.7 contain a stored cross-site scripting (XSS) vulnerability caused by improper escaping of image attribute values during page output rewriting, specifically through image class attribute backreference e...