CVE-2026-96682 Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-96106

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96682

The Presto Player plugin for WordPress (versions up to and including 4.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the comment content via the tag. An unauthenticated attacker can inject arbitrary web scr...

CVE-2026-103424

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96064

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103424 Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103424

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 6.88 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter . An una...

CVE-2026-104915 Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

CVE-2026-104915

The Academy LMS plugin for WordPress (versions

KPOT-string-decrypter

KPOT-string-decrypter IDA python scripts for decrypting KPOT stealer's strings and setting those as comments next to the var that would receive them during runtime. It works as follows: Gets the offset that's passed on eax to either decryption function there are two, which is why this repo has tw...

WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion vulnerability

Missing Authorization to Authenticated Custom+ Arbitrary Academy Comment Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...

CVE-2026-102422

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

CVE-2025-70886

CVE-2025-70886 A Proof of Concept PoC exploit for CVE-2025-70886, a persistent denial-of-service vulnerability in Halo CMS v2.22.4 and earlier that allows remote attackers to crash the admin comment interface by submitting malformed payloads. Basic Information Product Vendor: 凌霞软件 Vendor Website:...

hdwebmobile-photo-video-reviews

HDWebmobile Photo & Video Reviews A WooCommerce plugin that lets customers attach photos and short videos to their product reviews, shown right in the review list on the product page. WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ pending first submission Requires:...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload ⚠️ Disclaimer THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. The...

Wordpress_cve-2019-9787_defense

Wordpresscve-2019-9787defense Notice This is a project by Sijia Zhanghttps://github.com/sijiahi and Bowen Zhouhttps://github.com/KonjakZhou Prerequisite: 1 Recurrence Attack: - Configure and install Wordpress5.0 under http://localhost/wp-admin/; - Log in Wordpress as admin, post at least one...

CVE-2021-28378

CVE-2021-28378 Details about this CVE here. This CVE targets a missing string escaping on the client-side from content fetched from the server. It enables an attacker to inject arbitrary code easily, by creating a comment on an issue or a pull request. This was introduced in commit...

Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

CVE-2026-95112

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...