CVE-2026-97660 WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

EUVD-2026-91952

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

monsoon

monsoon Un énumérateur HTTP rapide qui vous permet d'exécuter un grand nombre de requêtes HTTP, de filtrer les réponses et de les afficher en temps réel monsoon est un fuzzer HTTP rapide et flexible qui peut être utilisé pour une grande variété d'actions allant de la découverte de contenu au...

WhatTheHack

What The Hack - Dépôt Bienvenue dans le dépôt What The Hack sur GitHub. Ce dépôt contient du contenu pour Coachs conçu pour les personnes qui planifient d'organiser un événement What The Hack avec des étudiants dans une organisation. Si vous êtes une organisation intéressée par la participation o...

chameleon

Chameleon Chameleon обеспечивает более эффективное обнаружение контента, используя набор технологических отпечатков wappalyzer вместе с пользовательскими списками слов, адаптированными под каждую обнаруженную технологию. Инструмент легко настраивается и позволяет пользователям добавлять собственн...

CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-85568

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

CVE-2026-101923

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcprimageuploadid parameter of a public review submission into the review's...

CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-88783

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to restrict the expansion of allowed HTML elements solely to the editor context; instead, the wider set of allowed ...

CVE-2026-88783 Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

EUVD-2026-91938

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

CVE-2026-85568 Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...

CVE-2026-85568

The Unlimited Elements for Elementor WordPress plugin, in versions before 2.0.21 , is vulnerable to SQL injection because it fails to correctly handle a search value before rewriting an already prepared SQL statement. This flaw allows unauthenticated users to perform SQL injection attacks and ret...

6cy

sixcy — Format de conteneur .6cy Une implémentation Rust du format d'archive .6cy offrant : Blocs auto-descriptifs : chaque bloc porte son propre magic, version, UUID de codec, tailles et sommes de contrôle d'intégrité Vérification d'intégrité obligatoire : contrôles CRC32 sur les en-têtes +...

ffuf

ffuf - Fuzz Faster U Fool Un fuzzer web rapide écrit en Go. Installation Exemples d'utilisation Découverte de contenu Découverte de vhosts Fuzzing de paramètres Fuzzing de données POST Utilisation d'un mutateur externe Fichiers de configuration Aide Mode interactif Installation Téléchargez un...

SecurityExplained

Security Explained SecurityExplained — новая серия, продолжающая предыдущий цикл обучающих испытаний Learn365. Цель серии SecurityExplained — создавать информационный контент в разных форматах и делиться им с сообществом, чтобы способствовать получению знаний и обучению. Ниже перечислены различны...

htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.8 . The root cause is insufficient input sanitization and output escaping related to a predictable {rstr_keep} placeho...

EUVD-2026-91914

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...