CVE-2024-3105-PoC

CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; Elementor's editor sanitizes input on the client side, but the REST API endpoint /wp-json/wp/v2/posts/id accepts the elementordata meta field directly and bypasses that layer entirely. An authenticated Contributo...

CVE-2026-118081

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

CVE-2026-118080 WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Social Snap = 1.5.4 versions...

CVE-2026-118081 WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Social Photo Feed = 1.5.6 versions...

CVE-2026-118080

The Social Snap WordPress plugin (versions

CVE-2026-118081

The 10Web Social Photo Feed plugin for WordPress, affecting versions

CVE-2026-118076 WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Frisbii Pay = 1.8.19 versions...

CVE-2026-118076

The Frisbii Pay WordPress plugin, affecting versions

CVE-2026-118075

The WP Media folders plugin for WordPress, affecting versions

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

CVE-2026-119054

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the mpg and mpgmatch shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by...

misp-dashboard

misp-dashboard A dashboard showing live data and statistics from the ZMQ feeds of one or more MISP instances. The dashboard can be used as a real-time situational awareness tool to gather threat intelligence information. The misp-dashboard includes a gamification tool to show the contributions of...

CVE-2026-119054

The Multiple Pages Generator by Themeisle plugin, versions prior to 4.2.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the base-url attribute of the [mpg] and [mpg_match] shortcodes. An attacker with Contributor-level privileges can inject entity-encoded payloads that...

EUVD-2026-112820

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the mpg and mpgmatch shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by...

CVE-2026-118192

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-104727

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104727 Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104727

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.5 . The root cause is insufficient input sanitization and output escaping within the 'condition' Post Meta Array Keys . This allows authenti...