WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

CVE-2026-78071

DPCalendar Free 中通过位置标题触发的存储型 XSS DPCalendar Free ≤ 10.11.2 — 作者角色用户绕过内容审核，通过位置标题注入持久型 XSS，任何访客悬停时触发 -orange 摘要 $location-title 字段在 defaultlocations.php 中未经 htmlspecialchars 处理即被渲染。Joomla 服务端的 InputFilter::clean 会从字符串字段中剥离 ，但允许 " 通过，这使得作者（Author）角色用户能够突破 HTML 属性上下文。当任何访客将鼠标悬停在事件页面的位置信息区域时，注入的...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.44 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by VuxNx in WordPress Plugin Photo Gallery by 10Web versions = 1.8.44...

WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Filebird versions = 6.5.6...

WordPress VK All in One Expansion Unit plugin <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kyokito, Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin VK All in One Expansion Unit versions = 9.118.0...

WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability

Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-87836

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-91011

EWWW Image Optimizer is a WordPress plugin that optimizes images on pages. Versions before 8.7.7 contain a stored cross-site scripting (XSS) vulnerability caused by improper escaping of image attribute values during page output rewriting, specifically through image class attribute backreference e...

EUVD-2026-81354

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-81316

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

Exploits

エクスプロイト 私が書いたいくつかのエクスプロイト。...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 WordPress 플러그인 WPCode Lite Insert Headers and Footers v2.3.5 의 원격 코드 실행 RCE 취약점을 테스트하기 위한 익스플로잇 도구입니다. 이 취약점은 사용자 정의 게시글 유형CPT wpcode를 등록할 때 사용자 정의 capabilitytype을 정의하지 않아 발생합니다. 이 결함으로 인해 Author 역할또는 상위을 가진 모든 사용자가 XML-RPC를 통해 서버에서 임의의 PHP 코드를 실행할 수 있습니다. 크레딧 :...

WordPress FluentBoards plugin < 2.0.15 - Board Member+ Comment Author Spoofing vulnerability

Board Member+ Comment Author Spoofing vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 2.0.15...

CVE-2026-11996

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-80100

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-11996

The Advanced Popups WordPress plugin (versions ≤ 1.2.3 ) is vulnerable to Stored Cross-Site Scripting via the 'Notification Button Link' field, caused by insufficient input sanitization and output escaping. Authenticated attackers with author-level access or above can inject arbitrary web scripts...