## The Exploit An unauthenticated attacker can inject a stored XSS payload into a Rich-Text Textarea field; when a site administrator opens the submission in the Forminator Entries view and clicks a crafted link embedded in the stored data, the payload executes in the administra...
## The Exploit An unauthenticated attacker can inject a stored XSS payload into a Rich-Text Textarea field; when a site administrator opens the submission in the Forminator Entries view and clicks a crafted link embedded in the stored data...
Read article →## The Exploit An unauthenticated attacker with access to create or edit a Contact Form 7 payment form can inject arbitrary HTML and JavaScript into the `gateway` form field. When a WordPress admin visits the Payments admin panel to review...
Read article →## The Exploit An unauthenticated attacker registers a new user account via the Ultimate Member registration form, injecting a malicious `form_id` parameter containing arbitrary JavaScript. The payload is stored in the user's profile metad...
Read article →## The Exploit An unauthenticated attacker with the ability to publish public singular content (such as a bbPress forum topic) can inject arbitrary JavaScript into analytics tracking code by poisoning their author display name. The SEOPres...
Read article →## The Exploit An authenticated WordPress user with subscriber-level access can inject arbitrary shortcodes into a review submission that will execute when the review post is rendered on the front end. ```http POST /wp-admin/admin-ajax.ph...
Read article →## The Exploit An authenticated contributor who owns a draft Beaver Builder post can inject arbitrary SQL into the `get_autosuggest_values` AJAX endpoint via the `fields[][value]` parameter. The request below extracts the WordPress admin u...
Read article →## The Exploit An authenticated WordPress user with contributor-level access can permanently delete any reusable social message, including those authored by administrators, by sending a DELETE request to the REST API endpoint without owner...
Read article →## The Exploit An unauthenticated remote attacker can bypass the W3C Baggage specification 64 KiB size limit by sending an oversized `baggage` HTTP header, triggering denial of service or memory pressure on the Keycloak server. ```http GE...
Read article →## The Exploit An attacker with the ability to supply a malicious OOXML file (e.g., a `.docx` document) to Apache Tika for parsing can inject an XML External Entity (XXE) payload into the `docProps/custom.xml` component. ```xml <?xml vers...
Read article →