CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page...

CVE-2026-110018

The aBlocks plugin for WordPress (versions up to and including 2.17.0 ) is vulnerable to Privilege Escalation via the /ablocks/v1/form-builder/registration REST endpoint. The flaw stems from the endpoint using permission_callback => __return_true and failing to verify that the block's formType...

EUVD-2026-109265

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists...

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public...

SirepRAT

SirepRAT - RCE as SYSTEM on Windows IoT Core SirepRAT Features full RAT capabilities without the need of writing a real RAT malware on target. Context The method is exploiting the Sirep Test Service that’s built in and running on the official images offered at Microsoft’s site. This service is th...

psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

CVE-2026-97352

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from t...

CVE-2026-97353

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, ...

CVE-2026-113489

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

CVE-2026-113491

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

CVE-2026-97352

The News Kit Addons For Elementor WordPress plugin (versions prior to 1.4.9 ) is vulnerable to an authorization bypass. The software fails to perform a capability check on one of its AJAX actions, specifically involving nekit_install_importer. This flaw allows authenticated users with subscriber-...

CVE-2026-97353

The News Kit Addons For Elementor WordPress plugin, affecting versions through 1.4.7 , is vulnerable to an authorization bypass. An authenticated user with subscriber-level access or higher can exploit a missing capability or ownership check in an AJAX action (nekit_update_mega_menu_form ) to wri...

CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

EUVD-2026-109227

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, ...

EUVD-2026-109223

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from t...

CVE-2026-97353 News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, ...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...

CVE-2023-0157

CVE ID : CVE-2023-0157 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

CVE-2026-109933

The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...