CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

EUVD-2026-76801

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-87888

The YayPricing WordPress plugin before 3.5.7 is vulnerable to stored XSS caused by a missing authorization check on the save_page_data REST route that saves pricing rules. Users with the subscriber role or above can store malicious JavaScript that executes in the browser of an administrator who o...

CVE-2026-87891

Rox Appointment Booking WordPress plugin (before 1.2.0 ) is vulnerable to unauthenticated holiday schedule modification via the REST API due to a missing capability/authorization check. An unauthenticated attacker can overwrite the dates the booking system treats as unavailable, potentially block...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-81742

CVE-2026-81742 affects the BE REST Endpoints WordPress plugin through version 1.0.0 . The plugin's REST endpoints handle widget read, create, update, and delete operations without performing authorization checks and without sanitizing the values it stores. This allows unauthenticated attackers to...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 fails to prevent a temporary user from creating an Application Password and does not revoke one when the temporary access expires or is disabled. As a result, the recipient of a temporary login retains working access to the site o...

CVE-2022-1388

CVE-2022-1388 - F5 BIG-IP iControl REST Authentication Bypass RCE This Python script exploits CVE-2022-1388, a critical vulnerability in F5 BIG-IP iControl REST that allows unauthenticated remote command execution via improper access control and HTTP header handling. ⚠️ For educational and...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Slider Revolution Missing Authorization Scanner Professional mass scanner for CVE-2024-34444 affecting Slider Revolution WordPress plugin 6.7.0 Banner 🎯 Description CVE-2024-34444 is a Missing Authorization vulnerability in the Slider Revolution WordPress plugin versions 6.7.0...

CVE-2023-35085-POC-EXP

PS: All the scripts are achieved by Gemini 2.5 pro and CLaude 3.7. It may doesn't work well, because I don't know how to use the api "/mifs/rest/api/v2/command/exec", the same as the AIs, who pretented that they know it very well...

wp2shell-poc

wp2shell PoC WordPress REST API 배치 라우트 혼동 체인CVE-2026-63030 + CVE-2026-60137을 악용한 사전 인증pre-auth 타이밍 기반 SQL 인젝션 PoC 중 최초의 PoC입니다. 단순히 관리자 비밀번호를 크랙하려는 시도 없이 명령 실행을 달성했습니다. 영향을 받는 버전: WordPress 6.9.0–6.9.4 및 7.0.0–7.0.1. 6.9.5 및 7.0.2에서 수정되었습니다. root@kitploit: python3 poc.py https://target.example...

WP2Shell-CVE-2026-63030-POC

WP2Shell Detector and Validation PoC CVE coverage: CVE-2026-63030 and CVE-2026-60137 Intended use: Authorized security testing, defensive validation, and disposable localhost labs only WP2Shell is a WordPress Core vulnerability chain combining a pre-authentication REST API batch-route confusion b...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

Apache Kylin - Exposed Configuration File

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...