Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

WordPress Image Hover Ultimate - Unauthenticated Settings Update

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate versions = 9.6.1 WordPress plugin. id: CVE-2021-36888 info: name: WordPress Image Hover Ultimate - Unauthenticated Settings Update author: riteshs4hu severity:...

CVE-2018-7600.

IGLOO Corp, Won Chi Hyun Drupal RCE 分析レポート Drupal RCE CVE-2018-7600 スクリプトに自分のアドレスを忘れずに入力してください！ 説明: Drupal 7.x および 8.x の複数のサブシステムにリモートコード実行の脆弱性が存在します。これにより、攻撃者は Drupal サイト上の複数の攻撃ベクトルを悪用する可能性があり、サイトが完全に侵害される可能性があります。 解決策: Drupal 7 または 8 コアの最新バージョンにアップグレードしてください。 7.x を実行している場合は、Drupal 7.58...

CVE-2018-7600

CVE-2018-7600 的 POC Drupal RCE CVE-2018-7600 别忘了在脚本中填入你的地址！ 描述： Drupal 7.x 和 8.x 的多个子系统中存在一个远程代码执行漏洞。这可能允许攻击者利用多个攻击向量对 Drupal 站点发起攻击，从而导致站点被完全入侵。 解决方案： 升级到最新版本的 Drupal 7 或 8 核心。 如果你正在运行 7.x，请升级到 Drupal 7.58。（如果无法立即更新，你可以尝试应用此补丁来修复漏洞，直到你能够完全更新为止。） 如果你正在运行 8.5.x，请升级到 Drupal...

The vulnerability of the openssl_private_decrypt() function in the WPvivid Backup & Migration plugin of the WordPress content management system allows for the execution of arbitrary code and gives full control over the website.

The vulnerability of the opensslprivatedecrypt function in the WPvivid Backup & Migration plugin of the WordPress content management system is related to the ability to download unlimited files of a dangerous type. Exploiting this vulnerability allows an attacker, operating remotely, to execute...

CVE-2026-12394

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-12394

The MemberGlut WordPress plugin (versions before 1.1.5 ) is vulnerable to an unauthenticated privilege escalation due to a broken access control flaw. The plugin fails to validate the user role selected during front-end registration, which allows an unauthenticated attacker to register an account...

EUVD-2026-49066

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-63685: Improper Access Control

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially...

Exploit for CVE-2026-49048

CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection...

CVE-2026-8760

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otplloginaction was placed only inside the OTP-generation branch and is never...

Attackers replaced JDownloader installer downloads with malware

If you downloaded the JDownloader installer during the compromise window May 6-7, you are advised to verify the file. JDownloader is a popular download management application, particularly favored for automated downloads from file-hosting services, video sites, and premium link generators. The...

Emlog-v2.6.9-Vulnerability-Report

Emlog-v2.6.9-Vulnerability-Report CVE ID: REQUESTED D...

When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation

Overview Rapid7 Labs has identified and analyzed an ongoing, widespread compromise of legitimate, potentially highly trusted WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant impersonating a Cloudflare human verification challenge CAPTCHA. The lure is design...

CVE-2025-14156: Improper Input Validation

The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the /fox-lms/v1/payments/create-order REST API endpoint...

EUVD-2025-202995

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes ...

CVE-2025-14166

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes ...

CVE-2025-14166 WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes ...

CVE-2025-39663

Cross-Site Scripting XSS vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 eol...