## The Exploit An unauthenticated attacker can inject a stored XSS payload into a Rich-Text Textarea field; when a site administrator opens the submission in the Forminator Entries view and clicks a crafted link embedded in the stored data, the payload executes in the administra...
## The Exploit An authenticated attacker with contributor-level access can inject arbitrary JavaScript into a WordPress page via a malicious `iframeBox` shortcode. The payload persists in the post content and executes in the browsers of al...
Read article →## The Exploit An unauthenticated attacker with knowledge of a victim's email address can unsubscribe them from arbitrary mailing lists by brute-forcing a 32-character MD5 hash derived from the subscriber ID and email. No authentication, s...
Read article →## The Exploit Contributor-level or higher authenticated user (the minimum role needed to trigger the preview feature in Visual Link Preview). ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.local Content-Type: application/x-w...
Read article →## The Exploit An authenticated WordPress user with Editor role or above can inject arbitrary SQL by manipulating the search parameter in the Nelio AB Testing REST API endpoint. ```http POST /wp-json/nelio-ab-testing/v1/posts HTTP/1.1 Hos...
Read article →## The Exploit An authenticated WordPress user with subscriber-level permissions or higher can modify the default payment method setting for the entire RegistrationMagic plugin without holding administrative privileges. ```http POST /wp-a...
Read article →## The Exploit An attacker with network access to a FreeBSD host running WireGuard can modify in-flight tunnel packets without triggering authentication failure, provided they can estimate the receiver's replay window bounds. ```python #!...
Read article →## The Exploit An authenticated WordPress Author can forge requests to arbitrary internal hosts by poisoning the `$_SERVER['HTTP_HOST']` header through a crafted AJAX call. ```http POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerable-s...
Read article →## The Exploit **An unauthenticated attacker can retrieve campaign comments and metadata from any campaign by calling a REST endpoint with no authentication.** ```http GET /wp-json/give-api/v3/campaigns/comments?id=1&perPage=10 HTTP/1.1 H...
Read article →## The Exploit An unauthenticated attacker can inject arbitrary JavaScript into the WordPress admin dashboard by crafting a malicious directory entry with an HTML entity–encoded payload that decodes *after* sanitization. ```http POST /wp-...
Read article →