CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - 인증된구독자 이상 사용자에 대한 누락된 권한 확인으로 인한 임의 옵션 업데이트 설명 WordPress용 Minterpress 플러그인은 1.0.5 이하의 모든 버전에서 함수에 대한 권한 확인capability check 누락으로 인해 데이터의 무단 수정에 취약하며, 이로 인해 권한 상승이 발생할 수 있습니다. 이 취약점으로 인해 구독자Subscriber 이상의 접근 권한을 가진 인증된 공격자가 WordPress 사이트의 임의 옵션을 업데이트할 수 있습니다. 이를...

opensvp

Opensvp 소개 Opensvp는 프로토콜 수준 공격에 대한 방화벽의 저항성을 테스트하기 위해 "공격"을 구현하는 보안 도구입니다. Netfilter 세계에서 helper라고 불리는 응용 계층 게이트웨이에 대한 클래식한 공격뿐만 아니라 몇 가지 새로운 유형의 공격도 구현합니다. 예를 들어, opensvp는 특정 조건에서자세한 내용은 아래 설명 참조 ftp 서버를 보호하는 방화벽에 핀홀을 열 수 있습니다. 필터링 정책이 서버에 21번 포트만 열려 있음을 보장하더라도 opensvp를 사용하여 서버의 '임의의' 포트를 열 수...

WordPress Download Manager plugin <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Download Manager versions = 3.3.70...

WordPress WP Ultimate Review plugin <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Eunho Kim in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

CVE-2026-92767

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92767 Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-91967

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-92767

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.0.5 . The root cause is insufficient input sanitization and output escaping within the 'offset' Shortcode Attribute . This allows authenticated attackers with ...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-15795

The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103519

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

betwixt

Betwixt는 친숙한 Chrome DevTools 인터페이스를 사용하여 브라우저 외부의 웹 트래픽을 분석하는 데 도움을 줍니다. 설치하기 사용 중인 운영 체제에 맞는 최신 릴리스를 다운로드하거나, 직접 번들을 빌드하거나, 소스 코드에서 Betwixt를 실행하세요. 설정하기 트래픽을 캡처하려면 Betwixt가 백그라운드에서 생성한 프록시http://localhost:8008로 트래픽을 보내야 합니다. 시스템 전체 트래픽을 분석하려면: macOS - 시스템 환경설정 → 네트워크 → 고급 → 프록시 → 웹 프록시HTTP Windo...

CVE-2026-18443 Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...

EUVD-2026-91961

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...

CVE-2026-103519

The WP Ultimate Review plugin for WordPress (all versions up to and including 2.4.3 ) is vulnerable to arbitrary shortcode execution . The root cause is a failure to properly validate input before passing it to the do_shortcode function. Authenticated attackers with subscriber-level access or hig...

EUVD-2026-91959

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...