paperweight

Paperweight website Marketing site for Paperweight. Development Install deps from the repo root, then run Next.js in this package: pnpm -C website install pnpm -C website dev Production build pnpm -C website build pnpm -C website start Environment variables This site has two server-side API route...

Opti Marketing <= 2.0.9 - SQL Injection

The Opti Marketing plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appe...

Automation By Autonami < 3.3.0 - SQL Injection

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. id:...

CVE-2024-21388

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ Microsoft Edge...

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS This repository reveals a security vulnerability discovered in Motivian Content Management System v.41.0.0. CVE-2025-29094: Multiple Stored Cross-Site Scripting XSS This vulnerability was reported to the vendor in accordance with responsible...

CVE-2025-53072-CVE-2025-62481

CVE-2025-53072 & CVE-2025-62481 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. How does this detection method work? This Nuclei template detects Oracle E-Business Suite instances vulnerable to CVE-2025-53072 and CVE-2025-62481 by...

CVE-2026-111070

The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from each remotely-fetched article WPCPReadability::parsemeta,...

PT-2026-134473

Name of the Vulnerable Software and Affected Versions The Content Pilot – Autoblogging & Affiliate Marketing Suite versions prior to 2.2.5 Description Stored Cross-Site Scripting occurs when the plugin extracts HTML meta descriptions from remotely-fetched articles using the parse meta function in...

CVE-2026-111070: pluginever Content Pilot – Autoblogging & Affiliate Marketing Suite: The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site…

The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from each remotely-fetched article WPCPReadability::parsemeta,...

WordPress Content Pilot – Autoblogging & Affiliate Marketing Suite plugin <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin WP Content Pilot versions = 2.2.4...

CVE-2026-116852: Marketing Fire Widget Options: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Author Remote Code Execution RCE in Widget Options = 4.2.5 versions...

EUVD-2026-111613

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-111605

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109999

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

CVE-2026-109999 AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

EUVD-2026-111561

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

CVE-2026-109999

The AI Marketing Expert WordPress plugin is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.2.8 . The root cause is insufficient input sanitization and output escaping of the 'name' parameter . An unauthenticated attacker can inject arbitrary web sc...

CVE-2026-109999 AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...

PT-2026-127857

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-127886

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentcta label' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible fo...