CVE-2025-54352

CVE-2025-54352 PoC Usage Steps to install and test the WordPress PoC: 1. Install a fresh version of WordPress using Docker: 1.1 Start the MySQL database container: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d...

CVE-2025-66024

CVE-2025-66024: XWiki Blog Application home page vulnerable to Stored XSS via Post Title Overview Field| Details ---|--- CVE ID| CVE-2025-66024 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products org.xwiki.contrib.blog:application-blog-ui versions: alert'XSS in...

CVE-2026-117522

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

CVE-2026-117522

The Dynific Addons for Elementor (formerly Anywhere Elementor ) WordPress plugin, in versions before 1.3.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape the post title before outputting it within a quoted HTML attribute in one of its Elementor widget...

CVE-2026-117522 Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

EUVD-2026-123169

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

PT-2026-145005

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

CVE-2026-117522: Unknown Dynific Addons for Elementor (formerly Anywhere Elementor): The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post…

The Dynific Addons for Elementor formerly Anywhere Elementor WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as...

WordPress Secure Custom Fields plugin < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Secure Custom Fields versions 6.9.8...

WordPress Advanced Custom Fields (ACF®) plugin < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure vulnerability

Contributor+ Unpublished Post Title and Status Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Advanced Custom Fields versions 6.8.11...

WordPress Post Duplicator plugin < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure vulnerability

Contributor+ Draft and Private Post Title Disclosure vulnerability discovered by Luka Zimonjic in WordPress Plugin Post Duplicator versions 3.0.17...

PT-2026-116381

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

PT-2026-113716

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes i...

WordPress Envira Gallery plugin < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure vulnerability

Author+ Non-Public Post Title and Excerpt Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...

CVE-2026-42713

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

CVE-2026-42713

The Gopiplus Post title marquee scroll WordPress plugin (versions n/a through 9.9 ) is vulnerable to a Blind SQL Injection flaw. This issue is caused by the improper neutralization of special elements used in an SQL command. Successful exploitation allows an attacker to perform unauthorized datab...

EUVD-2026-94287

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

CVE-2026-42713 WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

CVE-2026-42713 WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Post title marquee scroll versions = 9.9...