plution

plution Prototype pollution scanner using headless chrome What this is Plution is a convenient way to scan at scale for pages that are vulnerable to client side prototype pollution via a URL payload. In the default configuration, it will use a hardcoded payload that can detect 11 of the cases...

plution

plution 헤드리스 크롬을 사용한 프로토타입 오염 스캐너 개요 Plution은 URL 페이로드를 통해 클라이언트 측 프로토타입 오염에 취약한 페이지를 대규모로 스캔하는 편리한 방법입니다. 기본 설정에서는 다음 문서에 나와 있는 11가지 사례를 탐지할 수 있는 하드코딩된 페이로드를 사용합니다: https://github.com/BlackFan/client-side-prototype-pollution/tree/master/pp 이것이 아닌 것 이것은 만능 도구가 아닙니다. 프로토타입 오염은 복잡한 문제입니다. 이 도구는 수동으...

CVE-2026-93430

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrtslivehandler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

CVE-2026-103909 Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-103909 Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

EUVD-2026-91922

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrtslivehandler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-93430 GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrtslivehandler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-93430

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.7.1 . The root cause is insufficient input sanitization and output escaping within the gdrts_live_handler AJAX action, specifically affecting the 'title' and 'url' Re...

CVE-2026-93430 GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrtslivehandler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-104508

Name of the Vulnerable Software and Affected Versions GD Rating System versions prior to 3.7.2 Description Insufficient input sanitization and output escaping in the gdrts live handler AJAX function allow unauthenticated attackers to perform Stored Cross-Site Scripting. By manipulating the title...

CVE-2026-93430: Improper Neutralization of Input During Web Page Generation

The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrtslivehandler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-104503

Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

PT-2026-104545

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.47 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting...

GHSA-GJJ5-9665-RWRC probe-image-size: Quadratic-time Denial of Service in the SVG Parser

Overview probe-image-size scans the SVG header with a searching regular expression, //. On input that contains many , the engine restarts the ^ scan at every position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected...

NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.2...

CVE-2026-94483

The Next.js React framework (versions 16.0.0 through 16.3.8 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Image Optimization component. The root cause is that the framework can follow attacker-controlled DNS resolution for remote URLs that match images.remotePatterns. T...