gryffin

ARCHIVED Gryffin beta Gryffin is a large scale web security scanning platform. It is not yet another scanner. It was written to solve two specific problems with existing scanners: coverage and scale. Better coverage translates to fewer false negatives. Inherent scalability translates to capabilit...

CVE-2026-11496

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2026-11496

The Woo PDF Invoice Builder WordPress plugin (also distributed as "PDF Builder for WooCommerce") versions up to and including 2.0.8 are vulnerable to Insecure Direct Object Reference (IDOR) in the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcp...

EUVD-2026-75929

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2025-15260

CVE-2025-15260: Autorización faltante / Control de acceso roto en el Plugin - MyRewards – Puntos de fidelidad y recompensas para WooCommerce Aviso: Este repositorio se crea solo con fines educativos y divulgación ética. La vulnerabilidad ha sido reportada de forma responsable al proveedor y ha si...

PT-2026-89863

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp notifications action bulk manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

PT-2026-89776

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-81801

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81803

Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...

CVE-2026-81791

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81788

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81783

Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...

CVE-2026-81275

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81782

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

CVE-2026-81803

CVE-2026-81803 affects the WordPress RepairBuddy plugin in versions 4.1224 and below . A Subscriber-level (low-privilege) user can achieve Remote Code Execution (RCE) , meaning any authenticated user with the lowest typical WordPress role could potentially execute arbitrary code on the server. Th...

EUVD-2026-75531

Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...

CVE-2026-81803 WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...

EUVD-2026-75530

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81801 WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81801

The WP-Stateless WordPress plugin (versions ≤ 4.4.1) is affected by a Settings Change vulnerability discovered by Johan Buenavida via Patchstack. The flaw allows a low-privileged user (e.g., subscriber) to modify settings they should not have access to, over a network with low complexity and no u...