EUVD-2026-96758

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96759

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

EUVD-2026-96754

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

EUVD-2026-96755

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

EUVD-2026-96756

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

EUVD-2026-96753

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-84251 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-84252 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84253 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84254 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin, version 1.0.3 and below , is vulnerable to unauthenticated arbitrary options updates. The root cause is a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify that the option be...

CVE-2026-84251

The click5 CRM add-on to Ninja Forms WordPress plugin (versions up to and including 1.0.1 ) is vulnerable to unauthenticated arbitrary options updates. The root cause is a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify if the op...

CVE-2026-84254

The click5 CRM add-on to Contact Form 7 WordPress plugin (versions through 1.0.4 ) is vulnerable to an unauthenticated arbitrary options update . The root cause is a lack of authorization and CSRF checks on a REST endpoint, combined with a failure to verify that the updated option belongs to the ...

CVE-2026-107694 Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator...

CVE-2026-107694

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin versions before 5.2.0 is vulnerable to a cross-vendor information disclosure. The plugin fails to verify that the vendor requesting a commission calculation is the owner of the account for which the calculation is...

CVE-2024-28397-Reverse-Shell

CVE-2024-28397-Reverse-Shell Reverse shell for CVE-2024-28397. Exploit works for js2py = v0.74 Requirements requests library pip install requests Python3 Netcat Or something that you can use as a listener for the reverse shell Usage For listener nc -lnvp 4444 For exploit python3 exploit.py...

cve-2026-23550-poc

CVE-2026-23550 PoC A small Bash tester for CVE-2026-23550. It requests the affected WordPress modular connector login endpoint, checks whether a wordpressloggedin cookie is issued, and attempts to confirm access to the admin dashboard. Warning: Use this tool only against systems you own or have...

CVE-2026-108523

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...

CVE-2025-2304-POC

CVE-2025-2304-POC PoC for CVE-2025-2304 — Camaleon CMS 2.9.0 privilege escalation via mass assignment on the password change endpoint. Vulnerability The /admin/users/:id/updatedajax endpoint does not filter the role parameter before passing it to the model update, allowing any authenticated user ...

CVE-2024-8682

CVE-2024-8682 - JNews Unauthenticated Registration PoC JNews = 11.6.6 has a vulnerability that allows unauthenticated user registration via the ?ajax-request=jnews endpoint, even when WordPress registration is disabled. This works by first retrieving a valid jnewsnonce through the jnewsrefreshnon...