CVE-2026-12739

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0 . The root cause is that the plugin does not properly verify user authorization before performing actions. An authenticated attacker ...

EUVD-2026-82760

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-82756

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the myprofileupdate function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplie...

WordPress WP Cloud Plugins - Box (Lets-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Box Lets-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Lets-Box versions 2.0-3.8.3...

CVE-2026-89413

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89138

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89138

The Filter Gallery plugin for WordPress is affected by an authorization bypass in all versions up to and including 1.1.4 . The root cause is a missing authorization check in the ufg_save_gallery AJAX action, specifically via the image_id parameter. This allows authenticated attackers with subscri...

EUVD-2026-82726

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89413 Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page history.pushState'', '', '/'; document.forms0.submit; root@kitploit: "success":true,"data":"tempurl":...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - 구독자+ 저장형 교차 사이트 스크립팅 프로필 필드를 통한 설명 Discy 및 Himer 테마의 보조 플러그인으로 사용되는 이 플러그인은 프로필 페이지에서 도시, 전화번호 또는 프로필 자격 증명 필드를 출력할 때 이스케이프 및 살균 처리를 하지 않아, 인증된 사용자가 교차 사이트 스크립팅XSS 공격을 수행할 수 있습니다. 개념 증명 프로필을 편집하고 이스케이프되지 않은 필드 중 하나에 다음 페이로드를 추가하십시오. 프로필을 방문하면 XSS가 트리거됩니다. 버전 5.2에서 수정됨 참고...

gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...

CVE-2023-47504-POC

CVE-2023-47504 PoC CVE-2023-47504에 대한 익스플로잇. NIST에 따르면, 이 취약점은 인증되지 않은 사용자가 Elementor Website Builder 플러그인의 기능에 접근할 수 있도록 허용해야 합니다. 취약점에 대한 연구와 Patchstack에서 취약점을 설명하는...

CVE-2026-14855

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-14855

The RT Mega Menu WordPress plugin (all versions up to and including 1.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) through the css[left] parameter, processed via the rtmega_update_menu_options AJAX action. The root cause is insufficient input sanitization and output escaping . Authent...

EUVD-2026-82644

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - REST API権限昇格によるRCE PoC 完全版 影響を受けるバージョン: 5.0.0 から 7.2.0 ユーザー要件: 購読者ユーザー 手法: REST APIを介した管理者への権限昇格とRCEのトリガー エンドポイント: /v1/members/me エンドポイント Dockerの使い方 root@kitploit: git clone https://github.com/HoangKien1020/CVE-2021-21389 cd CVE-2021-21389/ docker build . -t...