Publicly Disclosed
PoC Exploits

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

A security vulnerability has been identified in UTT HiPER 1200GW, affecting versions up to 2.5.3-170306. The issue lies within the strcpy function of the /goform/pptpSrvGlobalConfig file, where improper handling of the EncryptionMode argument can lead to a stack-based buffer overflow. This vulner...

The InfiniteWP Client for WordPress contains a security flaw where the plugin fails to verify the connection state and the authenticity of requests at its remote management endpoint, particularly within WordPress Multisite setups. This oversight permits unauthenticated attackers to bind a malicio...

The LWS Optimize plugin for WordPress prior to version 4.1.2 contains an improper input validation vulnerability. This flaw allows attackers to exploit an unauthenticated analytics endpoint, enabling them to inject arbitrary web scripts into the administrative dashboard. When an administrator acc...

The CubeWP Framework WordPress plugin prior to version 1.1.31 contains a significant vulnerability due to improper sanitization and lack of capability checks on an AJAX action. This flaw allows users with Subscriber-level access and higher to execute SQL injection attacks, potentially compromisin...

The WP MAPS PRO plugin for WordPress prior to version 6.1.3 lacks proper capability checks for certain AJAX actions. This oversights allows unauthenticated users to exploit these actions, leading to potential uncontrolled recursion. As a result, attackers may consume server resources excessively,...

An SQL injection vulnerability exists in the WP Directory Kit plugin for WordPress, versions prior to 1.5.5. This issue arises due to inadequate sanitization and escaping of user-supplied parameters before they are incorporated into SQL statements. As a result, unauthenticated attackers may explo...

The PiWeb Cancel order/Refund request feature in the WooCommerce plugin for WordPress versions prior to 1.3.4.34 lacks essential authorization checks. This vulnerability enables unauthenticated users to access and disclose the contents of other customers' orders without permission. Moreover, it a...

The Create WordPress plugin, prior to version 2.5.4, lacks proper authorization checks on one of its public REST API routes. This oversight allows unauthenticated attackers to access unpublished content, which can be rendered and made publicly available through the API. The vulnerability compromi...

The WPC Order Tip for WooCommerce plugin prior to version 3.3.1 is susceptible to an authorization bypass due to the lack of proper nonce verification and authorization checks in its reporting functionality. This oversight permits unauthorized individuals to access sensitive order information for...

The WP MAPS PRO plugin for WordPress prior to version 6.1.3 is prone to a security vulnerability due to the lack of capability checks in AJAX actions accessible to unauthenticated users. This oversight permits unauthorized attackers to exploit file inclusion vulnerabilities by supplying a user-co...

The Nexter Blocks WordPress plugin prior to version 5.0.2 suffers from improper access control, allowing users with a Contributor role to save arbitrary CSS through its REST endpoints. This oversight enables potential attackers to inject CSS that can alter the site's appearance, facilitating meth...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 lacks proper capability and nonce checks for its public REST endpoint actions. This vulnerability allows unauthenticated users to delete ZIP archives of generated album exports, potentially leading to unauthorized loss of us...

The WP Data Access plugin for WordPress before version 5.5.79 contains a vulnerability where it fails to properly validate column names in an unauthenticated AJAX action. This oversight permits attackers to manipulate requests and gain unauthorized access to the database. Specifically, they could...

The Create WordPress plugin versions prior to 2.5.4 contain a significant vulnerability where an authorization check is not enforced on certain REST API routes. This oversight allows attackers to access unpublished content without authentication, potentially leading to unauthorized exposure of se...

The Iptanus File Upload plugin for WordPress prior to version 5.1.8 contains a vulnerability where a lack of proper sanitization and escaping of a specific parameter allows unauthenticated users to execute SQL injection attacks. This oversight can lead to unauthorized access to sensitive data or ...

The GeoDirectory WordPress plugin, prior to version 2.8.169, lacks necessary authorization checks when returning map marker data for individual listings. This flaw allows unauthorized users to access and reveal details such as the title and geographic coordinates of listings that are pending or i...

The Solace Extra plugin for WordPress, prior to version 1.6.1, has a notable design flaw where it lacks proper capability and nonce checks for specific AJAX operations. This vulnerability allows any authenticated user, including subscribers, to make unauthorized modifications to post meta data on...

The Slim SEO WordPress plugin prior to version 4.9.11 allows users with the Contributor role to access post-meta data that they should not be able to view. This vulnerability occurs because the plugin does not adequately restrict access to the post-meta preview feature. As a result, users can rea...

A confusion issue in the REST API batch endpoint of WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 could facilitate an exploit. This vulnerability, when combined with an existing SQL Injection flaw in the author__not_in WP_Query feature, can allow attackers to execute unauthoriz...

A flaw in the Linux kernel's xfs filesystem can lead to stale data fork mappings during operations involving ILOCK cycles. The xfs_reflink_fill_{cow_hole,delalloc} functions, which manage data and cow fork mappings, may fail to refresh the data fork mapping when reacquiring the ILOCK. This oversi...

A vulnerability exists in the Linux kernel's rtmutex component where the remove_waiter() function incorrectly utilizes current instead of waiter::task during a dequeue operation within various mutex handling paths. This mismanagement leads to multiple issues, including potential use-after-free vu...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

The Flowise application version 3.1.4 is susceptible to a server-side request forgery (SSRF) vulnerability due to an inadequate deny-list configuration in its SSRF guard found in httpSecurity.ts. Specifically, the default configuration omits critical endpoints associated with Oracle Cloud Infrast...

The awslabs.aws-transform-mcp-server tool from Amazon contains a vulnerability due to improper validation of the savePath parameter, which could allow an attacker to write files outside the designated working directory. This issue affects versions 0.1.0 through 0.1.4. Users are encouraged to upgr...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

IPFire version 2.19 is susceptible to a Remote Command Injection vulnerability through its ids.cgi component. The issue arises from improper handling of the OINKCODE parameter allowing authenticated users to execute arbitrary shell commands. This vulnerability can be exploited directly or via Cro...

An unauthenticated remote code execution vulnerability has been identified in JetBrains TeamCity prior to version 2026.1.3 and 2025.11.7. This weakness is exposed through the agent polling protocol, allowing attackers to execute arbitrary code without authentication, posing significant risks to t...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

A command injection vulnerability has been identified in the MCPGateway by Abdullah1854, specifically within the 'getUsageByDateRange' function located in the file 'src/services/claude-usage.ts'. This vulnerability arises due to improper handling of input parameters, allowing an attacker to manip...

WordPress is susceptible to a pre-auth reflected cross-site scripting (XSS) vulnerability on the login interface. This security issue allows attackers to exploit a specially crafted malicious webpage designed to lure users into interaction. Although this gateway typically leads to XSS, it represe...

The h2 library, which is a pure-Python implementation of the HTTP/2 protocol stack, has a vulnerability that allows for potential request smuggling. This occurs in versions up to and including 4.4.0, where the library incorrectly handles request header blocks containing multiple Host headers. Sub...

The h2 library, which is a pure-Python implementation of the HTTP/2 protocol stack, has a vulnerability that allows for potential request smuggling. This occurs in versions up to and including 4.4.0, where the library incorrectly handles request header blocks containing multiple Host headers. Sub...

The Solace Extra plugin for WordPress suffers from an access control vulnerability due to inadequate capability checks in its AJAX actions. This flaw allows users with minimal privileges (such as Subscribers) to manipulate crucial site-wide settings and delete imported site-builder content, there...

The AI Engine WordPress plugin prior to version 3.6.6 lacks proper validation of caller-supplied file paths, allowing individuals with subscriber-level access to read arbitrary files from the server. This vulnerability can lead to unauthorized data exfiltration when a specific public API feature ...

The AI Engine WordPress plugin prior to version 3.6.4 suffers from a vulnerability that allows an unauthenticated attacker to delete user-uploaded chatbot files. This security flaw arises due to insufficient verification of the ownership of uploaded files, relying solely on a client-supplied sess...

The Download Monitor plugin for WordPress prior to version 5.2.6 contains a vulnerability that allows unauthenticated users to bypass authorization checks on specific AJAX actions. This inadequacy permits unauthorized parties to inject arbitrary download log entries, leading to the potential infl...

The WP Directory Kit plugin for WordPress versions before 1.5.5 is susceptible to an authorization flaw during one of its authenticated AJAX actions. This vulnerability allows any authenticated user, including those with minimal privileges such as Subscribers, to access sensitive site information...

The WP Directory Kit plugin for WordPress is subject to an authorization bypass vulnerability due to improper checks on an authenticated AJAX action. This flaw enables any authenticated user, including those with minimal roles such as Subscriber, to access and retrieve stored contact messages and...

The WP Directory Kit plugin for WordPress, prior to version 1.5.5, contains a significant security flaw that lacks proper authorization and nonce validation on an authenticated AJAX action. This oversight enables any authenticated user, such as a Subscriber, to access and potentially disclose sen...

The WP Directory Kit plugin for WordPress suffers from a security flaw that allows SQL injection attacks due to inadequate sanitization and escaping of parameters in authenticated AJAX actions. The vulnerability is particularly concerning because it lacks proper authorization and nonce checks. Th...

The YMC Filter plugin for WordPress prior to version 3.12.9 is susceptible to an improper input validation vulnerability that fails to sanitize SVG files uploaded via icon upload features. This oversight allows low-privileged users, including those with an Author role, to upload malicious files c...

The Dokan plugin for WooCommerce, version prior to 5.0.11, has a significant access control vulnerability. It fails to adequately verify that a downloadable product is associated with the requesting vendor, exposing a risk where an authenticated vendor could inadvertently grant their customers un...

The WP Statistics plugin for WordPress, prior to version 14.16.10, is susceptible to a security flaw due to inadequate capability checks on certain AJAX handlers for dashboard analytics. This vulnerability allows users with Subscriber-level access or higher to access and potentially disclose sens...

The Admin Safety Guard plugin for WordPress, specifically in versions prior to 1.4.0, suffers from a critical vulnerability due to a lack of capability checks on its REST API endpoint. This oversight permits unauthenticated attackers to access sensitive information, including a comprehensive list...

The Link Library plugin for WordPress versions prior to 7.9.4 is susceptible to reflected cross-site scripting (XSS). The plugin fails to properly sanitize and escape a specific parameter that is echoed back in HTTP responses. This oversight allows unauthenticated attackers to exploit the vulnera...

The YMC Filter plugin for WordPress, prior to version 3.12.8, contains a significant access control flaw. The plugin fails to properly sanitize and escape a layout builder setting when it is outputted on a public endpoint. Additionally, it lacks verification of object ownership during the saving ...

The Appointment Hour Booking plugin for WordPress contains a flaw that allows unauthenticated users to submit a booking price that is not validated against the server-side configured service price. This lack of validation means users can set any final price, including zero or negative values, whi...

The Newsletters plugin for WordPress is susceptible to an API authentication bypass due to inadequate type comparison of its API authentication key. This flaw enables unauthenticated attackers to exploit the plugin, particularly when the optional API feature is enabled. By leveraging type jugglin...

The Newsletters plugin for WordPress, prior to version 4.16, is susceptible to a PHP Object Injection vulnerability. This flaw occurs due to improper handling of unserialised data retrieved from public form submissions. Attackers, without authentication, can exploit this weakness to inject malici...