halo-2.25.4-CVE-2026-67919

Halo 2.25.4 中通过未经验证的插件 URI 安装实现认证远程代码执行（RCE） 1. 漏洞概述 在 Halo 2.25.4 版本中发现了一个严重的安全漏洞。该应用提供了一个管理端点，用于从远程 URI 安装或升级插件。然而，系统未能验证 URI 的源域名，并且在该特定组件上缺乏服务端请求伪造（SSRF）防护。具有插件管理权限的认证攻击者可以提供指向恶意构造的插件 JAR 文件的链接。服务器将使用 PF4J 框架和 Spring 的 DefaultPluginApplicationContextFactory 下载、临时存储并将该 JAR 文件动态加载到 JVM...

CVE-2026-0911

CVE-2026-0911 — Hustle Module Import PoC A research / pentest helper tool that tests the upload behavior via the authenticated module import endpoint for the WordPress plugin Hustle wordpress-popup, WPMU DEV under CVE-2026-0911. The CVE-2026-0911.py script in this repository or file set should on...

CVE-2025-7963

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-1844

PixelYourSite PRO - 未认证存储型跨站脚本（CVE-2026-1844） 概述 WordPress 的 PixelYourSite PRO 插件在 12.4.0.2 及之前的所有版本中，由于对 'pysTrafficSource' 参数和 'pyslandingpage' 参数的输入清理和输出转义不足，存在存储型跨站脚本漏洞。这使得未认证的攻击者能够在页面中注入任意 Web 脚本，当用户访问被注入的页面时，这些脚本将执行。 关键要点 严重性 ：严重 CVSS 评分 ：7.2（高危） 攻击向量 ：网络 点击此处下载...

CVE-2026-75528

CVE-2026-75528 affects the Broken Link Checker plugin for WordPress in all versions up to and including 2.4.13 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping in the Comment Author URL / Link Log functionality. An unauthenti...

CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963

The Easy Waveform Player WordPress plugin (versions ≤ 1.2.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) in the shortcode_easywaveformplayer() function due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access or above can inject arbitra...

EUVD-2025-210826

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Broken Link Checker plugin <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Broken Link Checker versions = 2.4.13...

CVE-2026-82883

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-3844

CVE-2026-3844 批量利用工具 CVE-2026-3844 – Breeze Cache WordPress =2.4.4 在启用本地 Gravatar 托管时，允许通过 fetchgravatarfromremote 进行未认证文件上传。 安装 下载仓库 root@kitploit: git clone https://github.com/im-hanzou/CVE-2026-3844 进入仓库文件夹 root@kitploit: cd CVE-2026-3844 安装依赖 root@kitploit: pip install -r requirements.txt 使用方...

CVE-2026-82883 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-82883

CVE-2026-82883 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Login With Ajax by Marcus , affecting versions from n/a through 4.5.1 . The root cause is improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts th...

CVE-2026-81426

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81427

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81737

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-81432

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

CVE-2026-81199

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

CVE-2026-81428

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

CVE-2026-81807

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...