CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.8 . The root cause is insufficient input sanitization and output escaping related to a predictable {rstr_keep} placeho...

CVE-2025-12828

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.2 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the Type Out widget . This allows authen...

CVE-2026-96650 Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

EUVD-2026-91904

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-96650

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.11 . The root cause is insufficient input sanitization and output escaping of the 'platform_user_photo' Custom Field. An unauthenticated attacker can inject arbi...

CVE-2020-35262

CVE-2020-35262: Stored XSS in Digisol DG-HR3400 Router Vulnerability Description It has been identified that the vulnerable endpoint doesn't have server side input validation and lacks client side filtering for any malicious script injection. An attacker can use this vulnerability to inject...

CVE-2026-92727

The EmbedPress plugin for WordPress (versions up to and including 4.6.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'slidesShow' Block Attribute . Specifically, the attribute is interpolated into an unquot...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.3.5 . The root cause is insufficient input sanitization and output escaping, specifically where a page-wide regex strips closing quo...

CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100180

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-55182-Exploit

React2Shell CVE-2025-55182 - Docker Vulnerable Lab An intentional vulnerable Next.js application demonstrating Remote Code Execution RCE via insecure Child Process handling. This lab is designed for educational purposes and security testing. ⚠️ WARNING: DOT NOT RUN THIS ON A PUBLIC FACING SERVER...

bigdecimal-segfault-fix

h1. BigDecimal Segfault Fix There is a segfault bug in ruby's big decimal library which can be triggered by users providing known-bad values. If you wish to test whether your application is secure run +example.rb+. This script should exit normally, not segfault. The workaround has negative...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-91877

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

TP-LINK - Local File Inclusion

TP-LINK is susceptible to local file inclusion in these products: Archer C5 1.2 with firmware before 150317, Archer C7 2.0 with firmware before 150304, and C8 1.0 with firmware before 150316, Archer C9 1.0, TL-WDR3500 1.0, TL-WDR3600 1.0, and TL-WDR4300 1.0 with firmware before 150302, TL-WR740N...

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...