WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

CVE-2021-29447

WordPress 5.6-5.7 - 認証済み Author+ XXE CVE-2021-29447 使用方法 ステップ1. WordPressを起動 root@kitploit: $ make up-wp ステップ2. 攻撃者用Webサーバーを起動 root@kitploit: $ make up-mal ステップ3. 悪意のあるWAVファイルを生成 wavefile npmを使わない場合 推奨 root@kitploit: $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick;...

CVE-2026-80071

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

EUVD-2026-76952

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

CVE-2026-80071

CVE-2026-80071 affects the User Registration & Membership WordPress plugin in versions before 5.2.8 . The vulnerability stems from improper access controls: the plugin does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account. This allow...

CVE-2026-90489

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2026-89264

MoguBlog through 6.2 is vulnerable to comment author spoofing in the POST /web/comment/add endpoint. The server fails to validate that the userUid supplied in the request body matches the authenticated session, allowing any authenticated user to post comments attributed to any other account, incl...

CVE-2026-89264 MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

Easy Media Replace 0.2.0 Cross Site Scripting

Easy Media Replace version 0.2.0 and below suffer from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231132...

WordPress Insert or Embed Articulate Content into WordPress plugin < 4.3000000025 - Author+ Upload to RCE vulnerability

Author+ Upload to RCE vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Insert or Embed Articulate Content into WordPress versions 4.3000000025...

CVE-2026-4657

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

EUVD-2026-75240

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

CVE-2026-4657 Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

CVE-2026-4657

Easy Google Fonts WordPress plugin (≤ 2.0.4) is vulnerable to an authenticated stored cross-site script via the control_selectors meta field. The plugin registers this field with show_in_rest enabled but omits a sanitize_callback, then outputs the unsanitized value directly into tags on the fron...

WordPress Easy Google Fonts plugin <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kitch in WordPress Plugin Easy Google Fonts versions = 2.0.4...

CVE-2026-87819

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.nameemailregex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic...

EUVD-2026-74845

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.nameemailregex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic...