CVE-2026-9696

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notfound' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2026-102401

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

WordPress Download Manager plugin <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Download Manager versions = 3.3.58...

WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Feedzy versions = 5.2.10...

WordPress Download Manager plugin <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Download Manager versions = 3.3.71...

CVE-2024-3105-PoC

CVE-2024-3105 PoC إضافة Woody code snippets – Insert Header Footer Code, AdSense Ads لـ WordPress معرّضة لثغرة تنفيذ الأكواد عن بُعد Remote Code Execution في جميع الإصدارات حتى 2.5.0 ضمنًا، عبر shortcode 'insertphp'. يعود السبب إلى أن الإضافة لا تقيّد استخدام هذه الوظيفة على المستخدمين المصرح لهم...

misp-dashboard

misp-dashboard A dashboard showing live data and statistics from the ZMQ feeds of one or more MISP instances. The dashboard can be used as a real-time situational awareness tool to gather threat intelligence information. The misp-dashboard includes a gamification tool to show the contributions of...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — Contributor+ Stored XSS via Custom Field Meta Key | ---|--- CVE ID| CVE-2026-88997 الحالة| PUBLISHED CNA| WPScan تاريخ النشر| 2026-09-23 آخر تحديث| 2026-09-23 CWE| CWE-79: Cross-Site Scripting XSS الوصف إن إضافة JSM Show Post Metadata الخاصة بـ...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia لـ WordPress وBuddyPress وbbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869 RTMediaQuery-populateda...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; يقوم محرر Elementor بتعقيم المدخلات على جانب العميل، لكن نقطة نهاية REST API /wp-json/wp/v2/posts/id تقبل حقل البيانات الوصفية elementordata مباشرة وتتجاوز تلك الطبقة بالكامل. يمكن لأي مساهم مصادق عليه إرسال طلب...

CVE-2026-28134

تقرير استغلال CVE-2026-28134 JetEngine = 3.7.2 — تنفيذ تعليمات برمجية عن بُعد عبر Twig SSTI للمستخدمين المصادق عليهم مساهم فأعلى التاريخ: 11 مارس 2026 درجة CVSS: 8.8 عالية متجه CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H الإضافة المتأثرة: JetEngine = 3.7.2 معرّف الإضافة: jet-engine CVE:...

CVE-2021-42362

CVE-2021-42362 إضافة WordPress Popular Posts لووردبريس معرضة لتحميل ملفات عشوائية بسبب عدم كفاية التحقق من نوع ملف الإدخال الموجود في ملف /src/Image.php مما يجعل من الممكن للمهاجمين ذوي مستوى المساهم وما فوقه تحميل ملفات ضارة يمكن استخدامها للحصول على تنفيذ كود عن بُعد...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

EUVD-2026-94763

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

EUVD-2026-94764

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...