How wpForo let anyone who knew a guest author's email rewrite that author's forum post by forging the WordPress comment author cookie, and what the 3.1.6 fix changed.

YouTube video by BruCON Security Conference

Root cause analysis of CVE-2026-89093 in Better Messages, where an unauthenticated guest sets a request header to impersonate the plugin's AI chat bot, passing every chat room permission check to read...

Root cause analysis of CVE-2026-18442 in WCFM Marketplace, where unauthenticated checkout delivery coordinates reached a store-distance SQL query and allowed a blind read of WordPress password hashes.

Root cause analysis of CVE-2026-14311 in Amelia, where a customer endpoint authenticated the provider token but never checked which customer the provider owned, letting any Employee read, edit, and re...

Root cause analysis of CVE-2026-18555 in Better Messages, where the Live Chat Builder preview rendered an SVG icon from a GET parameter through a regex sanitiser that a browser could parse back into a...

Root cause analysis of CVE-2026-18063 in the Job Postings WordPress plugin, where a 2.8.1 escaping change left the position_button field unescaped and gave a Contributor stored XSS that fires in an ad...

Root cause analysis of CVE-2026-18579 in WP Photo Album Plus, where an unauthenticated X-Forwarded-For header became the acting user in the error log and ran as script when an administrator opened the...

How a gap in Ninja Forms repeater validation let anonymous visitors create a script-bearing HTML file on the site's own origin when File Uploads was active.

Root cause analysis of CVE-2026-45308 in libarchive, where the ZIP writer copies an oversized entry pathname into a fixed 64 KiB central-directory buffer and writes past the end of it.

YouTube video by Rapid7

Root cause analysis of CVE-2026-11851 in ASUS router firmware, where existing input validation failed to prevent an authenticated bwdpi SQL injection.

Root cause analysis of CVE-2026-18100 in MetForm, where a non-numeric mf_form_id widget setting is echoed into a JavaScript template that the plugin compiles in the browser, giving a Contributor store...

Root cause analysis of CVE-2026-11780 in Quiz and Survey Master, where the REST question-create endpoint stored an unsanitised question_title that the Question Bank rendered as raw HTML for administra...

YouTube video by Rapid7

Root cause analysis of CVE-2026-18501 in UsersWP, where the badge renderer decodes an entity-encoded Subscriber profile value and outputs it as unescaped HTML.

Rapid7 analyzes KindaRails2Shell (CVE-2026-66066), a Ruby on Rails Active Storage vulnerability that can allow attackers to abuse libvips and crafted MAT/HDF5 uploads to read arbitrary files from the ...

Root cause analysis of CVE-2026-15156 in Essential Addons for Elementor Lite, where a Contributor-controlled Reading Progress colour is stored globally and rendered without escaping, causing stored XS...

Root cause analysis of CVE-2026-15155 in Essential Addons for Elementor Lite, where a Contributor-controlled Login/Register widget setting injects a Bcc header into the administrator password reset em...

Root cause analysis of CVE-2026-9145 in Contact Form Entries, where the 1.5.1 rewrite of create_entry_el() fed an Elementor upload field's raw POST value into PHP copy(), letting an unauthenticated at...

Root cause analysis of CVE-2026-4610 in ProfileGrid, where any Subscriber can store an invisible onclick overlay in another user's private message inbox and turn an admin's next click into a new admin...

Root cause analysis of a stored XSS in HedgeDoc 2's slideshow renderer, where a Reveal data-background-iframe attribute carrying a javascript: URL survives DOMPurify and is later loaded as an iframe s...

Root cause analysis of CVE-2026-53943 in Ghost CMS, an unauthenticated cache-poisoning XSS where one anonymous request poisons any caching layer in front of Ghost with attacker-controlled JavaScript t...

Root cause analysis of CVE-2026-9829 in Photo Gallery by 10Web, where compact album shortcode sort direction was stored then later reached an album ORDER BY clause and allowed Contributor+ time-based ...

### Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors (e.g., Fastly, Cloudflare, nginx proxy_cache, and others), an unauth...

YouTube video by CryptoCat

YouTube video by Rapid7

YouTube video by CryptoCat

Root cause analysis of CVE-2026-4609 in ProfileGrid, where a nonce-only AJAX invite flow lets Subscriber-level users add themselves or other registered users to closed and paid groups.

YouTube video by TrendAI Zero Day Initiative

While researching a critical authentication bypass vulnerability, CVE-2026-20127, which was exploited in-the-wild, Rapid7 Labs discovered a new authentication bypass vulnerability affecting Cisco Cata...

Root cause analysis of CVE-2026-4608 in ProfileGrid, where the messaging profile view trusted the rid parameter inside a raw SQL fragment and exposed authenticated SQL injection to Subscriber-level us...

YouTube video by Rapid7

Root cause analysis of CVE-2026-6127 in Elementor Website Builder, where form-encoded REST API requests bypass _elementor_data sanitisation and lead to Contributor+ stored XSS.

YesWeHack Dojo #50 writeup: the app checks the original filename, then signs a cleaned-up version of it, letting us turn a public path into directory traversal

Application security teams often deploy AI-powered scanners that use Large Language Models (LLMs) to scan web applications for vulnerabilities. While ...

A closer look at Mozilla's Firefox 150

YouTube video by CryptoCat

YesWeHack Dojo #49 writeup: exploiting wildcard argument injection in shell cp and grep commands to access internal secrets