alue": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-6028-01": {"action": "init", "conditions": [{"name": "ARGS:ays_questions", "type": "regex", "value": "~(?:[^0-9, ].*[^0-9, ]|(?:UNION|SELECT|SLEEP|BENCHMARK|OR|AND|INSERT|UPDATE|DELETE|DROP|CONCAT|CHAR|0x[0-9a-fA-F]{2}|/\\\\*|\\\\*/|--)\\\\s)~i"}], "cve": "CVE-2024-6028", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.5.8.3"}, "RULE-CVE-2024-6088-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/learnpress/v1/(?:users/)?register(?:[/?&#]|$)|[?&]rest_route=/learnpress/v1/(?:users/)?register(?:[/?&#]|$))~i"}], "cve": "CVE-2024-6088", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.1"}, "RULE-CVE-2024-6265-01": {"action": "init", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by parameter on front-end users page", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6265-02": {"ajax_action": "uwp_ajax_user_sorting_action", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by on AJAX user sorting handler", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection", "ajax"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6328-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6328-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login_v2(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6330-01": {"ajax_action": "gmw_info_window_init", "conditions": [{"name": "ARGS:form[info_window_template][content_path]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[a-z]+://|^/)~i"}], "cve": "CVE-2024-6330", "method": "POST", "mode": "block", "severity": 9.8, "slug": "geo-my-wp", "target": "plugin", "versions": "<4.5.0.2"}, "RULE-CVE-2024-6353-01": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:search[value]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|CONCAT\\\\s*\\\\(\\\\s*0x|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via search[value] in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-02": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:order[0][column]", "type": "regex", "value": "~(?:SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s|\\\\(SELECT\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via order[0][column] in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-03": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:order[0][dir]", "type": "regex", "value": "~(?:,\\\\s*\\\\(?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s|(?:^|\\\\s)(?!ASC$|DESC$)[A-Z]{3,}\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via order[0][dir] in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-04": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:start", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*FROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via start parameter in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6353-05": {"ajax_action": "draw_wallet_transaction_details_table", "conditions": [{"name": "ARGS:length", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*FROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-6353", "description": "Wallet for WooCommerce <=1.5.4 authenticated SQL injection via length parameter in draw_wallet_transaction_details_table", "mode": "block", "severity": 8.8, "slug": "woo-wallet", "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2024-6365-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"name": "ARGS:settings[order]", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings[order] written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6365-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings phrase parameters written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6366-02": {"ajax_action": "query-attachments", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-6366", "method": "POST", "mode": "block", "severity": 9.1, "slug": "profile-builder", "target": "plugin", "versions": "<=3.11.7"}, "RULE-CVE-2024-6451-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~\\\\.(?:php|php[0-9]+|phtml)\\\\b~i"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6451-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~^(?![^\\\\n]*\\\\.log$)[^\\\\n]+$~"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6455-01": {"ajax_action": "ekit_widgetarea_content", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6455", "description": "ElementsKit Lite <=3.2.0 unauthenticated information exposure via ekit_widgetarea_content AJAX action exposing drafts, pending and private posts", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2024-6460-01": {"ajax_action": "tm_load_data", "conditions": [{"name": "ARGS:component", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|(?:php|data|expect|phar|zip)://)~i"}], "cve": "CVE-2024-6460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6460", "description": "Grow by Tradedoubler <=2.0.21 unauthenticated Local File Inclusion via tm_load_data AJAX component parameter", "mode": "block", "severity": 9.8, "slug": "tradedoubler-affiliate-tracker", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.0.21"}, "RULE-CVE-2024-6500-01": {"action": "parse_request", "conditions": [{"name": "ARGS:easypack_download", "type": "regex", "value": "~(\\\\.\\\\.(?:[/\\\\\\\\]|%2f|%5c)|%2e(?:%2e|\\\\.(?:%2f|%5c|[/\\\\\\\\]))|%2e%2e(?:%2f|/|%5c|\\\\\\\\)|^/|^[A-Za-z]:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6500", "description": "InPost for WooCommerce <=1.4.4 unauthenticated arbitrary file read/delete via easypack_download query var", "mode": "block", "severity": 10.0, "slug": "inpost-for-woocommerce", "tags": ["missing-authorization", "path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-6522-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"name": "ARGS:name", "type": "exists"}, {"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6522", "description": "Modern Events Calendar Lite <=7.12.1 authenticated (subscriber+) SSRF via mec_fes_form AJAX action", "method": "POST", "mode": "block", "severity": 9.6, "slug": "modern-events-calendar-lite", "tags": ["ssrf", "server-side-request-forgery", "authenticated", "cwe-918"], "target": "plugin", "versions": "<=7.12.1"}, "RULE-CVE-2024-6589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6624-01": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-01G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6660-01": {"ajax_action": "bookingpress_import_data_continue_process_func", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6660", "description": "BookingPress <=1.1.5 missing authorization on bookingpress_import_data_continue_process_func allows subscriber+ arbitrary options update and file upload", "mode": "block", "severity": 8.8, "slug": "bookingpress-appointment-booking", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2024-6691-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php$~"}, {"name": "ARGS:option_page", "type": "equals", "value": "edd_settings"}], "cve": "CVE-2024-6691", "method": "POST", "mode": "block", "severity": 4.0, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:edd_settings[agree_text]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-6692", "method": "POST", "mode": "block", "severity": 3.1, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6704-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-02": {"ajax_action": "wpdAddInlineComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddInlineComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-03": {"ajax_action": "wpdGuestAction", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via guest comment submission", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6723-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6809-01": {"ajax_action": "qcsmd_upvote_action", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-6809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6809", "description": "Simple Video Directory <=1.4.2 unauthenticated SQL injection via id parameter in qcsmd_upvote_action AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "simple-media-directory", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-6849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (async-upload.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/media-new\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (media-new.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (REST /wp/v2/media)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-7031-01": {"ajax_action": "njt_fs_save_setting_restrictions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7031-02": {"ajax_action": "njt_fs_save_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7094-01": {"action": "init", "conditions": [{"name": "ARGS:form_request", "type": "equals", "value": "jssupportticket"}, {"name": "ARGS:jstmod", "type": "equals", "value": "themes"}, {"name": "ARGS:task", "type": "equals", "value": "savetheme"}, {"name": "ARGS:/color[1-7]/", "type": "regex", "value": "~[\\"\'`;]|<\\\\?(?:php|=)|[$][a-zA-Z_]~"}], "cve": "CVE-2024-7094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7094", "description": "JS Help Desk <=2.8.6 unauthorized frontend savetheme dispatch via formhandler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "js-support-ticket", "tags": ["missing-authorization", "code-injection", "frontend-form"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-7112-01": {"ajax_action": "dopbsp_calendar_schedule_set", "conditions": [{"name": "ARGS:schedule", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via schedule parameter in dopbsp_calendar_schedule_set AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7112-02": {"ajax_action": "dopbsp_calendar_schedule_get", "conditions": [{"name": "ARGS:schedule", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via schedule parameter in dopbsp_calendar_schedule_get AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7112-03": {"ajax_action": "dopbsp_calendar_schedule_set", "conditions": [{"name": "ARGS:calendar_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via calendar_id parameter in dopbsp_calendar_schedule_set AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7112-04": {"ajax_action": "dopbsp_calendar_schedule_get", "conditions": [{"name": "ARGS:calendar_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7112", "description": "Pinpoint Booking System <=2.9.9.5.0 authenticated SQL injection via calendar_id parameter in dopbsp_calendar_schedule_get AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-system", "target": "plugin", "versions": "<=2.9.9.5.0"}, "RULE-CVE-2024-7122-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7122-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor REST save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7257-01": {"ajax_action": "yaye_handle_upload_file", "conditions": [{"name": "FILES:option_field_data", "type": "exists"}], "cve": "CVE-2024-7257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7257", "description": "YayExtra \\u2013 WooCommerce Extra Product Options <=1.3.7 unauthenticated arbitrary file upload via yaye_handle_upload_file AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yayextra", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2024-7258-01": {"ajax_action": "myajax-delete-feed-file", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed file deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7258-02": {"ajax_action": "myajax-delete-feed", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7302-01": {"ajax_action": "b2s_upload_video", "conditions": [{"name": "ARGS:post_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouse(?:down|up|over|out|move)|key(?:down|up|press)|focus|blur|change|submit|reset|select|abort|dragstart|drag|dragend|drop)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-7302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7302", "description": "Blog2Social <=7.5.4 stored XSS via post_title in video upload", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=7.5.4"}, "RULE-CVE-2024-7315-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/[^/]+\\\\.(?:zip|sql|gz|tar|json|txt|log)(?:\\\\?|$)~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7315-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/wpvivid_log/~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7385-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wshs_saved"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 authenticated (Admin+) SQL injection via id parameter in wshs_saved delete action", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7385-02": {"ajax_action": "wshs_save_shortcode", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 SQL injection via id parameter in wshs_save_shortcode AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7493-01": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:role", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via role parameter in registration", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-02": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_capabilities", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-03": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_user_level", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7514-01": {"ajax_action": "product_comments_csv_import_request", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2[Ee]){2}%2[Ff]|(?:%252[Ee]){2}%25(?:2[Ff]|5[Cc])|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-7514", "description": "Comments Import & Export <=2.3.7 authenticated arbitrary file read via path traversal in file parameter", "mode": "block", "severity": 6.5, "slug": "comments-import-export-woocommerce", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-7548-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7590-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7590-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7607-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "feup-users"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7607", "description": "Front End Only Users <=3.2.28 authenticated SQL injection via order parameter on feup-users admin page", "mode": "block", "severity": 8.8, "slug": "front-end-only-users", "target": "plugin", "versions": "<=3.2.28"}, "RULE-CVE-2024-7656-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|&quot;|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via devvn_ihotspot shortcode unserialize sink \\u2014 write-time block on content param", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7656-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|&quot;|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via post_content carrying devvn_ihotspot serialized object", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7703-01": {"ajax_action": "arm_upload_front", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_front", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-02": {"ajax_action": "arm_upload_cover", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_cover", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-03": {"ajax_action": "arm_upload_profile", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_profile", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-04": {"ajax_action": "arm_import_user", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file import in arm_import_user", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7717-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/edit.php"}, {"name": "ARGS:post_type", "type": "equals", "value": "tp_event"}, {"name": "ARGS:orderby", "type": "exists"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\bOR\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2024-7717", "description": "WP Events Manager <=2.1.11 authenticated SQL injection via order parameter in admin event list sorting", "mode": "block", "severity": 8.8, "slug": "wp-events-manager", "target": "plugin", "versions": "<=2.1.11"}, "RULE-CVE-2024-7770-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~file-manager/libs/elFinder/php/connector~i"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2024-7770", "description": "Bit File Manager <=6.5.5 block direct access to elFinder connector with dangerous file upload", "mode": "block", "severity": 8.8, "slug": "file-manager", "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2024-7856-01": {"ajax_action": "removeTempFiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7856", "description": "MP3 Music Player by Sonaar <=5.7.0.1 missing authorization (subscriber+) arbitrary file deletion via removeTempFiles AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mp3-music-player-by-sonaar", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=5.7.0.1"}, "RULE-CVE-2024-7857-01": {"ajax_action": "mlf_change_sort_type", "conditions": [{"name": "ARGS:sort_type", "type": "detectSQLi"}], "cve": "CVE-2024-7857", "method": "POST", "mode": "block", "severity": 6.5, "slug": "media-library-plus", "target": "plugin", "versions": "<=8.2.2"}, "RULE-CVE-2024-7982-01": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:first_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via first_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7982-02": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:last_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via last_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7985-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess)$~i"}], "cve": "CVE-2024-7985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7985", "description": "File Organizer <=1.0.9 authenticated arbitrary file upload via filename extension bypass", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["arbitrary-file-upload", "authenticated", "file-upload"], "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2024-8252-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in post content (post.php)", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8252-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in REST API post creation", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8271-01": {"ajax_action": "woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (custom_prices parameter flows to do_shortcode at classes/woocs.php:4600)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8271-02": {"ajax_action": "nopriv_woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (nopriv hook)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8275-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|EXTRACTVALUE\\\\s*\\\\(|CONCAT\\\\s*\\\\(|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-8275", "description": "The Events Calendar <=6.6.4 unauthenticated SQL injection via order parameter in tribe_has_next_event template tag", "method": "GET", "mode": "block", "severity": 9.8, "slug": "the-events-calendar", "target": "plugin", "versions": "<=6.6.4"}, "RULE-CVE-2024-8289-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/?(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PUT", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PATCH", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_users"}], "cve": "CVE-2024-8289", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/batch(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8353-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address_2", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_city", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_state", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_zip", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_name", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_number", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-09": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_cvc", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-10": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_month", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-11": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_year", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-12": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:billing_country", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-13": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-14": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-15": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8485-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/watch-life-net/v1/weixin/updateuserinfo(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-8485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8485", "description": "REST API TO MiniProgram <=4.7.1 unauthenticated arbitrary user email update and privilege escalation via updateuserinfo REST endpoint IDOR", "method": "POST", "mode": "block", "severity": 9.8, "slug": "rest-api-to-miniprogram", "tags": ["authorization-bypass", "idor", "privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.7.6"}, "RULE-CVE-2024-8500-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS via su_generator_preview shortcode/atts/content parameters reaching echo sink in Su_Generator::preview", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8500-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS/code-flow via su_generator_settings shortcode parameter reaching echo/call_user_func sinks", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8519-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "um_loggedin"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|toggle|begin|end)\\\\s*=|javascript\\\\s*:|<\\\\s*iframe[\\\\s>]|<\\\\s*svg[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-8519", "description": "Ultimate Member <=2.8.6 stored XSS via um_loggedin shortcode lock_text attribute or inner content", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-8522-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/learnpress/v1/courses~"}, {"name": "ARGS:c_only_fields", "type": "regex", "value": "~(?i)(SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\(SELECT\\\\b|UNION\\\\s+SELECT\\\\b)~"}], "cve": "CVE-2024-8522", "description": "LearnPress <=4.2.7 unauthenticated SQL injection via c_only_fields parameter in REST courses endpoint.", "method": "GET", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.1"}, "RULE-CVE-2024-8529-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:c_fields", "type": "detectSQLi"}], "cve": "CVE-2024-8529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8529", "description": "LearnPress <= 4.2.7 unauthenticated SQL injection via c_fields parameter on the REST endpoint /wp-json/lp/v1/courses/archive-course. The REQUEST_URI regex is intentionally used alongside action: rest_api_init to tightly scope detection to only the known vulnerable REST route, avoiding false positives on other LearnPress REST endpoints that do not consume c_fields/c_only_fields.", "mode": "block", "severity": 9.8, "slug": "learnpress-wordpress-lms-plugin", "tags": ["sqli", "unauthenticated", "rest-api", "learnpress"], "target": "plugin", "versions": "<=4.2.7"}, "RULE-CVE-2024-8529-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:c_only_fields", "type": "detectSQLi"}], "cve": "CVE-2024-8529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8529", "description": "LearnPress <= 4.2.7 unauthenticated SQL injection via c_only_fields parameter on the REST endpoint /wp-json/lp/v1/courses/archive-course. The REQUEST_URI regex is intentionally used alongside action: rest_api_init to tightly scope detection to only the known vulnerable REST route, avoiding false positives on other LearnPress REST endpoints that do not consume c_fields/c_only_fields.", "mode": "block", "severity": 9.8, "slug": "learnpress-wordpress-lms-plugin", "tags": ["sqli", "unauthenticated", "rest-api", "learnpress"], "target": "plugin", "versions": "<=4.2.7"}, "RULE-CVE-2024-8549-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:edit\\\\.php|post\\\\.php|post-new\\\\.php|admin\\\\.php|options-general\\\\.php).*[?&].*(?:post_type=calendar|page=simple-calendar)~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc]|<)(?:[a-zA-Z/!]|%2[Ff])|(?:%22|%27|\\"|\')\\\\s*(?:%3[Ee]|>)|javascript(?:%3[Aa]|:)|on(?:load|error|click|focus|mouseover|mouseenter|toggle|animationstart|animationend|pointerdown|pointerover|wheel|keydown|keyup|blur|change|submit|input)\\\\s*(?:%3[Dd]|=)|(?:%3[Cc]|<)(?:script|svg|img|iframe|body|input|object|embed|link|style|meta|video|audio|details|marquee)~i"}], "cve": "CVE-2024-8549", "description": "Simple Calendar (google-calendar-events) <=3.4.2 reflected XSS via admin_notices add_query_arg URL reflected from REQUEST_URI without esc_url", "mode": "block", "severity": 6.1, "slug": "google-calendar-events", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-8672-01": {"ajax_action": "widgetopts_migrator", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-8672", "description": "Widget Options <=4.0.7 widgetopts_migrator AJAX handler lacks nonce and capability checks, allowing authenticated users to trigger file delete/upload/include operations via the import-export migrator flow", "mode": "block", "severity": 9.9, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2024-8800-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(%3Cscript|<script\\\\b|javascript:|<[^>]*onerror\\\\s*=|<[^>]*onload\\\\s*=|<[^>]*onclick\\\\s*=|\\\\bonerror\\\\s*=|\\\\bonload\\\\s*=|\\\\bonclick\\\\s*=|%22%3E|%27%3E)~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8800-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)%3cscript|<img\\\\b[^>]*onerror\\\\s*=|<a\\\\b[^>]*href\\\\s*=\\\\s*[\'\\"]javascript:~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8853-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:user_login", "type": "contains", "value": "-wfuser"}], "cve": "CVE-2024-8853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8853", "description": "Webo-facto <=1.40 unauthenticated privilege escalation via user_login containing -wfuser substring", "method": "POST", "mode": "block", "severity": 9.8, "slug": "webo-facto-connector", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.40"}, "RULE-CVE-2024-8978-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(\\\\{\\\\{password\\\\}\\\\}|%7B%7Bpassword%7D%7D)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-8978", "method": "POST", "mode": "block", "severity": 5.7, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-8979-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|eael_get_token|save_settings_with_ajax|save_eael_elements_data)$~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[user_password\\\\]~i"}], "cve": "CVE-2024-8979", "description": "Essential Addons for Elementor Lite <=6.0.9 sensitive information disclosure via [user_password] placeholder in lostpassword email template (Login_Register widget)", "mode": "block", "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-8981-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^blc_(?:dash|local)$~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3[Cc]script[\\\\s%]|%22\\\\s*on\\\\w+\\\\s*%3[Dd])~i"}], "cve": "CVE-2024-8981", "description": "Broken Link Checker <=2.4.0 reflected XSS via unsanitized add_query_arg on admin notice page (blc_dash/blc_local)", "mode": "block", "severity": 7.1, "slug": "broken-link-checker", "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2024-9018-01": {"ajax_action": "wpeg_shortcode", "conditions": [{"name": "ARGS:key", "type": "exists"}, {"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|(?:\'|%27)\\\\s*(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:\'|%27)\\\\s*(?:AND|OR)\\\\s+.*(?:SLEEP|BENCHMARK)|--\\\\s|/\\\\*[!+]|#\\\\s)~i"}], "cve": "CVE-2024-9018", "description": "WP Easy Gallery <=4.8.5 authenticated SQL injection via key parameter in wpeg_shortcode AJAX handler", "mode": "block", "severity": 8.8, "slug": "wp-easy-gallery", "target": "plugin", "versions": "<=4.8.5"}, "RULE-CVE-2024-9047-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wfu_file_downloader\\\\.php~i"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|\\\\.\\\\.%2f|\\\\.\\\\.%5c|%2e%2e(?:%2f|%5c)|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2024-9047", "description": "WordPress File Upload (wp-file-upload) <=4.24.11 unauthenticated path traversal via file parameter in wfu_file_downloader.php allowing arbitrary file read/delete", "mode": "block", "severity": 9.8, "slug": "wp-file-upload", "target": "plugin", "versions": "<=4.24.11"}, "RULE-CVE-2024-9061-01": {"ajax_action": "shortcode_Api_Add", "conditions": [{"name": "ARGS:custom-popup", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9061", "description": "WP Popup Builder <=1.3.5 unauthenticated arbitrary shortcode execution via custom-popup parameter", "mode": "block", "severity": 9.8, "slug": "wp-popup-builder", "target": "plugin", "versions": "<=1.3.5"}, "RULE-CVE-2024-9263-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timetics/v1/customers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9263", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9263", "description": "WP Timetics <=1.0.25 unauthenticated account takeover via IDOR on REST customers endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "timetics", "tags": ["idor", "account-takeover", "unauthenticated", "rest-api", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.25"}, "RULE-CVE-2024-9390-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "modula-gallery"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via FancyBox attributes in gallery CPT settings", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9416-02": {"ajax_action": "add_images_to_gallery", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via add_images_to_gallery AJAX handler", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu-social-login/type/[^/]+(/|\\\\?|$)~"}, {"name": "ARGS:code", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9501", "description": "Wp Social Login and Register Social Counter <=3.0.7 authentication bypass via social login OAuth callback REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-social", "tags": ["authentication-bypass", "unauthenticated", "rest-api", "oauth"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2024-9504-01": {"ajax_action": "wpdevart_form_ajax", "conditions": [{"name": "FILES:file0", "type": "exists"}], "cve": "CVE-2024-9504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9504", "description": "Booking Calendar <=3.2.15 unauthenticated stored XSS via SVG file upload in wpdevart_form_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "booking-calendar", "tags": ["xss", "svg-upload", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2024-9598-01": {"ajax_action": "redux_p", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9598", "description": "AMP for WP CSRF via missing nonce validation on redux_p AJAX proxy endpoint", "mode": "block", "severity": 8.8, "slug": "accelerated-mobile-pages", "target": "plugin", "versions": "<=1.0.99.1"}, "RULE-CVE-2024-9634-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9634-02": {"action": "init", "conditions": [{"name": "ARGS:give_action", "type": "equals", "value": "purchase"}, {"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9636-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9636-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9655-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v[12]/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in REST API post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9655-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in classic editor post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9669-01": {"ajax_action": "njt_fs_save_setting", "conditions": [{"name": "ARGS:fm_locale", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.|%2e%2e[%2f%5c]|%252e%252e|%00)~i"}], "cve": "CVE-2024-9669", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9669", "description": "Filester <=1.8.5 local file inclusion via fm_locale path traversal in njt_fs_save_setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "filester", "tags": ["local-file-inclusion", "path-traversal"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2024-9707-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/ai-site-import(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9707", "method": "POST", "mode": "block", "severity": 9.8, "slug": "hunk-companion", "target": "plugin", "versions": "<=1.8.4"}, "RULE-CVE-2024-9769-01": {"ajax_action": "tsvg_check_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9769-02": {"ajax_action": "tsvg_get_attachment_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9881-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:learn_press_offline_payment[description]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9881", "method": "POST", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.2"}, "RULE-CVE-2024-9933-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wht_login/?(?:$|\\\\?|/(?:$|\\\\?))~"}], "cve": "CVE-2024-9933", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9933", "description": "WatchTowerHQ <=3.10.1 unauthenticated authentication bypass via empty access_token on /wht_login/ rewrite rule path", "method": "GET", "mode": "block", "severity": 9.8, "slug": "watchtowerhq", "tags": ["authentication-bypass", "unauthenticated", "missing-empty-value-check"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2024-9933-02": {"action": "parse_request", "conditions": [{"name": "ARGS:wht_login", "type": "exists"}, {"name": "ARGS:access_token", "type": "regex", "value": "~^.{0,35}$~"}], "cve": "CVE-2024-9933", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9933", "description": "WatchTowerHQ <=3.10.1 unauthenticated authentication bypass via invalid-length access_token query var", "method": "GET", "mode": "block", "severity": 9.8, "slug": "watchtowerhq", "tags": ["authentication-bypass", "unauthenticated", "missing-empty-value-check"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2024-9935-01": {"action": "init", "conditions": [{"name": "ARGS:rtw_pdf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2024-9935", "description": "PDF Generator Addon for Elementor Page Builder <=2.0.0 local file inclusion via rtw_pdf_file parameter", "mode": "block", "severity": 7.5, "slug": "pdf-generator-addon-for-elementor-page-builder", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2024-9993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_event_details_text"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_event_details_text in Event Calendar widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9994-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<(?:script|img|svg|iframe|details|video|audio|source)[\\\\s/>]|on(?:error|load|toggle|click|mouse\\\\w+|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9994", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2025-0215-01": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:uri", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via uri parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-02": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:initiate_restore", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via initiate_restore parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-03": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:showdata", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via showdata parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0308-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC)\\\\b|(?:[\'\\"]|\\\\d)(?:[\\\\s)]|/\\\\*[^*]*\\\\*/)*\\\\b(?:OR|AND|XOR)\\\\b(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)*(?:\\\\(*\\\\s*[\'\\"]?[\\\\w.]+[\'\\"]?\\\\s*(?:=|<>|!=|<=|>=|<|>)|\\\\(*\\\\s*(?:SELECT|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|IF|CASE|EXISTS|ELT|MAKE_SET|LOAD_FILE|GROUP_CONCAT|CONCAT|ASCII|SUBSTRING|SUBSTR|MID|ORD)(?:/\\\\*[^*]*\\\\*/)*\\\\(|(?:TRUE|FALSE|NULL)\\\\b\\\\s*(?:$|[-#;)]|/\\\\*)|\\\\bLIKE\\\\s*[\'\\"]?%)|\\\\(\\\\s*(?:/\\\\*[^*]*\\\\*/\\\\s*)?SELECT\\\\b[\\\\s(].{0,64}?\\\\bFROM\\\\b|\\\\b(?:RLIKE|REGEXP)\\\\s*\\\\(|\\\\binformation_schema\\\\b|\\\\bPROCEDURE\\\\s+ANALYSE\\\\b|[\'\\"`;(),=|&+\\\\~!<>@].{0,64}?\\\\b(?:SL(?:/\\\\*[^*]*\\\\*/)*EEP|BENCHMARK)(?:/\\\\*[^*]*\\\\*/)*\\\\(|\\\\b(?:EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|[\'\\"]\\\\s*(?:--(?:\\\\s|$)|#|/\\\\*))~is"}], "cve": "CVE-2025-0308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0308", "description": "Ultimate Member <=2.9.1 unauthenticated SQL injection via search parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2025-0311-01": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL (javascript:/data: URI injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-02": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-03": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-04": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0350-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wdcl_image_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Image Carousel widget attributes in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0350-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wdcl_logo_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Logo Carousel widget attributes in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0350-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wdcl_image_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Image Carousel widget attributes in content param", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0350-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wdcl_logo_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Logo Carousel widget attributes in content param", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0357-01": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "edit_profile_data"}, {"name": "FILES:avatar", "type": "exists"}], "cve": "CVE-2025-0357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0357", "description": "WPBookit <1.6.10 unauthenticated arbitrary file upload via edit_profile_data avatar", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpbookit", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<1.6.10"}, "RULE-CVE-2025-0365-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\\\/\\\\\\\\](?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|(?:^|[\\\\/\\\\\\\\\\"\'\\\\s])\\\\.env(?:$|[\\\\/\\\\\\\\\\"\'\\\\s])|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-0365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0365", "description": "JupiterX Core <=4.8.7 authenticated (Contributor+) arbitrary file read via path traversal in Elementor widget settings (actions param)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "tags": ["path-traversal", "local-file-inclusion", "authenticated", "elementor-widget"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0365-02": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~[\\\\/\\\\\\\\](?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|(?:^|[\\\\/\\\\\\\\\\"\'\\\\s])\\\\.env(?:$|[\\\\/\\\\\\\\\\"\'\\\\s])|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-0365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0365", "description": "JupiterX Core <=4.8.7 authenticated (Contributor+) arbitrary file read via path traversal in Elementor data param", "method": "POST", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "tags": ["path-traversal", "local-file-inclusion", "authenticated", "elementor-widget"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0366-01": {"ajax_action": "raven_form_frontend", "conditions": [{"name": "FILES:form_fields:content", "type": "regex", "value": "~<\\\\?(?:php|=)|<script\\\\b|shell_exec\\\\s*\\\\(|base64_decode\\\\s*\\\\(|system\\\\s*\\\\(|passthru\\\\s*\\\\(|eval\\\\s*\\\\(~i"}], "cve": "CVE-2025-0366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0366", "description": "Jupiter X Core <=4.8.7 SVG file upload with embedded PHP via raven_form_frontend AJAX handler (LFI-to-RCE chain stage 1)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["local-file-inclusion", "remote-code-execution", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0366-02": {"ajax_action": "raven_control_file_upload", "conditions": [{"name": "FILES:form_fields:content", "type": "regex", "value": "~<\\\\?(?:php|=)|<script\\\\b|shell_exec\\\\s*\\\\(|base64_decode\\\\s*\\\\(|system\\\\s*\\\\(|passthru\\\\s*\\\\(|eval\\\\s*\\\\(~i"}], "cve": "CVE-2025-0366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0366", "description": "Jupiter X Core <=4.8.7 SVG file upload with embedded PHP via raven_control_file_upload AJAX handler (LFI-to-RCE chain stage 1)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["local-file-inclusion", "remote-code-execution", "file-upload"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with dangerous URI scheme (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0370-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with dangerous URI scheme (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0370-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with event handler injection (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0370-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with event handler injection (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0393-01": {"ajax_action": "wpr_filter_grid_posts", "conditions": [{"name": "ARGS:grid_settings", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#~i"}], "cve": "CVE-2025-0393", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0393", "description": "Royal Elementor Addons <=1.7.1006 CSRF to Reflected XSS via wpr_filter_grid_posts grid_settings parameter", "mode": "block", "severity": 6.1, "slug": "royal-elementor-addons", "tags": ["xss", "csrf", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1006"}, "RULE-CVE-2025-0428-01": {"ajax_action": "wpaicg_import_prompts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-0428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0428", "description": "AI Power Complete AI Pack <=1.8.96 PHP Object Injection payload injection attempt via wpaicg_import_prompts", "method": "POST", "mode": "block", "severity": 7.2, "slug": "gpt3-ai-content-generator", "tags": ["object-injection", "deserialization", "php-object-injection", "ajax"], "target": "plugin", "versions": "<=1.8.96"}, "RULE-CVE-2025-0428-02": {"ajax_action": "wpaicg_export_prompts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-0428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0428", "description": "AI Power Complete AI Pack <=1.8.96 PHP Object Injection trigger attempt via wpaicg_export_prompts with serialized markers", "method": "POST", "mode": "block", "severity": 7.2, "slug": "gpt3-ai-content-generator", "tags": ["object-injection", "deserialization", "php-object-injection", "ajax"], "target": "plugin", "versions": "<=1.8.96"}, "RULE-CVE-2025-0466-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype", "type": "equals", "value": "sensei_message"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_message posts via REST search subtype parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0466-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype", "type": "equals", "value": "sensei_email"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_email posts via REST search subtype parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0466-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype[]", "type": "regex", "value": "~^sensei_message$~"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_message posts via REST search subtype[] array parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0466-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype[]", "type": "regex", "value": "~^sensei_email$~"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_email posts via REST search subtype[] array parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0469-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:builder", "type": "exists"}, {"name": "ARGS:builder", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|math|details|marquee|video|audio|body|input|textarea|select|form|base|meta)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|beforeunload|message|animationend|animationstart|pointerover|pointerenter)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-0469", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0469", "description": "Forminator <=1.39.2 Stored XSS via slider template prefix/suffix in form builder save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "forminator", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.39.2"}, "RULE-CVE-2025-0493-01": {"ajax_action": "mvx_announcements_refresh_tab_data", "conditions": [{"name": "ARGS:tabname", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.|\\\\.\\\\./|php://|phar://|data://|expect://|glob://)~i"}], "cve": "CVE-2025-0493", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.14"}, "RULE-CVE-2025-0506-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "rise-blocks/site-identity"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"(?:titleTag|taglineTag)\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*[<>][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (REST API post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "rise-blocks/site-identity"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"(?:titleTag|taglineTag)\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*[<>][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (classic post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0507-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|<script)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0507", "description": "Ticketmeo (ploxel) <=2.3.6 Stored XSS via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ploxel", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-0507-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|<script)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0507", "description": "Ticketmeo (ploxel) <=2.3.6 Stored XSS via shortcode attributes in post_content param (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ploxel", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-0507-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|<script)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0507", "description": "Ticketmeo (ploxel) <=2.3.6 Stored XSS via shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ploxel", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-0511-01": {"ajax_action": "welcart_confirm_check", "conditions": [{"name": "ARGS:customer[name1]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name1] in welcart_confirm_check AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0511-02": {"ajax_action": "welcart_confirm_check", "conditions": [{"name": "ARGS:customer[name2]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name2] in welcart_confirm_check AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0511-03": {"action": "init", "conditions": [{"name": "ARGS:customer[name1]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name1] in front-end checkout form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0511-04": {"action": "init", "conditions": [{"name": "ARGS:customer[name2]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name2] in front-end checkout form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0512-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\s[^\\\\]]*(?:<script|<iframe|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:&lt;|&#0*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0512-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\s[^\\\\]]*(?:<script|<iframe|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:&lt;|&#0*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/trx_addons/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+|(?:php|data|expect|phar|zip|compress\\\\.zlib|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal and PHP wrapper abuse in REST API. Blocks directory traversal (../../) and PHP stream wrappers (php://, phar://, etc.) in any parameter sent to /wp-json/trx_addons/ endpoints. Covers CVE-2020-10257 RCE vector and CVE-2025-0682 shortcode LFI when accessed via REST.", "mode": "block", "severity": 8.8, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "rest-api", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-02": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?!(?:fonts|images|css|js|assets|vendor|dist|lib|node_modules|wp-content|wp-includes|uploads|components|templates|shortcodes)[\\\\/])|(?:php|phar|expect|zip|compress\\\\.zlib|data|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal in template selector parameters (type, layout, template, view, skin) across all entry points \\u2014 AJAX, shortcodes, REST, front-end template loaders. Fires on init hook for maximum coverage. Covers 190+ theme-level LFI CVEs from AncoraThemes, axiomthemes, ThemeREX.", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "shortcode", "ajax", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-03": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log|(?:id_[rd]sa|authorized_keys))~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 defense-in-depth: block known sensitive file names in template selector parameters. Catches absolute path inclusion attempts without directory traversal (e.g., type=wp-config.php).", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "sensitive-file", "defense-in-depth", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0764-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-07": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] path traversal in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-08": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-09": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0804-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^clickwhale~"}, {"name": "ARGS:title", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0804", "description": "ClickWhale <=2.4.1 Stored XSS via link title on admin page", "method": "POST", "mode": "block", "severity": 5.4, "slug": "clickwhale", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mlcalc\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|expression\\\\s*\\\\()[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0805", "description": "Mortgage Calculator / Loan Calculator <=1.5.20 authenticated (Contributor+) Stored XSS via mlcalc shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mortgage-loan-calculator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.20"}, "RULE-CVE-2025-0805-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mlcalc\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|expression\\\\s*\\\\()[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0805", "description": "Mortgage Calculator / Loan Calculator <=1.5.20 authenticated (Contributor+) Stored XSS via mlcalc shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mortgage-loan-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.20"}, "RULE-CVE-2025-0808-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "houzez-property-feed-export"}, {"name": "ARGS:action", "type": "equals", "value": "deleteexport"}, {"name": "ARGS:export_id", "type": "exists"}], "cve": "CVE-2025-0808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0808", "description": "Houzez Property Feed <=2.4.21 CSRF leading to property feed export deletion via deleteexport action", "method": "GET", "mode": "block", "severity": 5.4, "slug": "houzez-property-feed", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": "<=2.4.21"}, "RULE-CVE-2025-0818-01": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:rm|zipdl)$~i"}, {"name": "ARGS:targets", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder rm/zipdl commands with traversal payloads in targets[]", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-deletion", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0818-02": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:rm|zipdl)$~i"}, {"name": "ARGS:target", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder rm/zipdl commands with traversal payloads in target", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-deletion", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0818-03": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:file|extract)$~i"}, {"name": "ARGS:target", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder file/extract commands with traversal payloads in target", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-read", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0818-04": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:mkdir|mkfile|rename)$~i"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder mkdir/mkfile/rename commands with traversal payloads in name", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-write", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0818-05": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:mkdir|mkfile|rename)$~i"}, {"name": "ARGS:target", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder mkdir/mkfile/rename commands with traversal payloads in target", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-write", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0818-06": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "archive"}, {"name": "ARGS:targets", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder archive command with traversal payloads in targets[]", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-access", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0818-07": {"ajax_action": "fma_load_fma_ui", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "archive"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]|Li4v|Li4\\\\\\\\~"}], "cve": "CVE-2025-0818", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0818", "description": "File Manager Advanced <=5.4.8 directory traversal via elFinder archive command with traversal payloads in name", "method": "POST", "mode": "block", "severity": 6.5, "slug": "file-manager-advanced", "tags": ["file-manager", "directory-traversal", "arbitrary-file-access", "elfinder"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-0821-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bit-assist/v1/widget-channels/update-sequence(/|\\\\?|$)~"}, {"name": "ARGS:widgetChannels[*][id]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-0821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0821", "description": "Bit Assist <=1.5.2 authenticated (Subscriber+) SQL injection via widgetChannels[id] in update-sequence REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "bit-assist", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-0860-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:autor", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via autor parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:frase", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via frase parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:idfrase", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via idfrase parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:aut", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via aut parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:autor", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via autor parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:frase", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via frase parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:idfrase", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via idfrase parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:aut", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via aut parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0863-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[idx_frame\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|\'\\\\s*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0863", "description": "Flexmls IDX <=3.14.28 Stored XSS via idx_frame shortcode attributes in classic post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexmls-idx", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.28"}, "RULE-CVE-2025-0863-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[idx_frame\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|\'\\\\s*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0863", "description": "Flexmls IDX <=3.14.28 Stored XSS via idx_frame shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexmls-idx", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.28"}, "RULE-CVE-2025-0897-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1)[\\\\s\\\\S])*?\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr parameter (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with javascript URI (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:expression|vbscript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with data URI (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1)[\\\\s\\\\S])*?\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr parameter (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:javascript\\\\s*:|expression|vbscript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with javascript/data URI (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0912-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[country]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[address1]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[address2]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[city]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[state]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[zip]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:firstName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:lastName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-09": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[country]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-10": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[address1]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-11": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[address2]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-12": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[city]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-13": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[state]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-14": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[zip]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-15": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:firstName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-16": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:lastName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0916-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment body logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0916-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment author name logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0918-01": {"ajax_action": "_email_logs", "conditions": [{"name": "ARGS:params[valSearch]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log list (action=_email_logs); blocks HTML/script payload in params[valSearch]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0918-02": {"ajax_action": "_detail_email_logs", "conditions": [{"name": "ARGS:params[id]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log detail (action=_detail_email_logs); blocks HTML/script payload in params[id]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0924-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:log", "type": "detectXSS"}], "cve": "CVE-2025-0924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0924", "description": "WP Activity Log <=5.2.2 unauthenticated stored XSS via username field on login form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-security-audit-log", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2025-0953-01": {"ajax_action": "_detail_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log detail", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0953-02": {"ajax_action": "_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log list", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0957-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email logs list AJAX - attacker-controlled email content may be rendered in logs; block XSS markers in search parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0957-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_detail_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email log detail AJAX - attacker-controlled email content may be rendered in log detail; block XSS markers in selector parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0968-01": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0968-02": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0969-01": {"ajax_action": "brizy_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0969", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0969", "description": "Brizy Page Builder <=2.7.16 authenticated sensitive information exposure via brizy_get_users AJAX action", "mode": "block", "severity": 6.5, "slug": "brizy", "tags": ["missing-authorization", "sensitive-information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=2.7.16"}, "RULE-CVE-2025-10000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~data:[^;]*(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|aspx?|jsp|jspx?|cfm|phtml|user\\\\.ini|htaccess|htpasswd)[^;]*;base64~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:format", "type": "regex", "value": "~^(?:\\\\.)?(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint - format parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10002-01": {"ajax_action": "clickwhale/admin/export_csv", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10002", "description": "ClickWhale <=2.5.0 authenticated SQL injection via id parameter in export_csv AJAX handler", "mode": "block", "severity": 4.9, "slug": "clickwhale", "tags": ["sql-injection", "authenticated", "csv-export"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-10036-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10039-01": {"ajax_action": "eh_crm_ticket_single_view_client", "conditions": [{"name": "ARGS:ticket_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10039", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.2.9 IDOR via eh_crm_ticket_single_view_client allows Subscriber+ to read any ticket", "method": "POST", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["idor", "missing-authorization", "insecure-direct-object-reference", "information-disclosure"], "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2025-10041-01": {"ajax_action": "flexqr_save_qr", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:PD9waHA|PD8g|PD8J|PD8N|PD8K)~"}], "cve": "CVE-2025-10041", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-10041-02": {"ajax_action": "flexqr_update_qr", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:PD9waHA|PD8g|PD8J|PD8N|PD8K)~"}], "cve": "CVE-2025-10041", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-10045-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:^|[\\\\\\\\/])onoffice-estates[\\\\\\\\/]*$~"}, {"name": "ARGS:order", "type": "regex", "value": "~[^A-Za-z0-9_-]~"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via the order parameter", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10045-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:^|[\\\\\\\\/])onoffice-estates[\\\\\\\\/]*$~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~[^A-Za-z0-9_-]~"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via the orderby parameter", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10046-01": {"ajax_action": "elex_gpf_manage_feed_remove_file", "conditions": [{"name": "ARGS:file_to_delete", "type": "detectSQLi"}], "cve": "CVE-2025-10046", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10046", "description": "ELEX WooCommerce Google Shopping <=1.4.3 authenticated SQL injection via file_to_delete in feed removal AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elex-woocommerce-google-product-feed-plugin-basic", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-10047-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-tracker"}, {"name": "ARGS:orderby", "type": "regex", "value": "~[(),\'\\"`]|\\\\bselect\\\\b|\\\\bcase\\\\b|\\\\bwhen\\\\b|\\\\bsleep\\\\b|\\\\bunion\\\\b|--\\\\s|/\\\\*~i"}], "cve": "CVE-2025-10047", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10047", "description": "Email Tracker <=5.3.15 authenticated (Admin+) SQL injection via orderby parameter in email list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-tracker", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=5.3.15"}, "RULE-CVE-2025-10048-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#)))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via order parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10048-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#)))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via orderby parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10049-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:HdnMediaSelection", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|cgi|asp|aspx|jsp|jspx|cfm|shtml)(?:\\\\?|%3[Ff]|%00|$)~i"}], "cve": "CVE-2025-10049", "method": "POST", "mode": "block", "severity": 7.2, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.24"}, "RULE-CVE-2025-1005-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-1005-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget in post content save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-10054-01": {"ajax_action": "eh_crm_remove_agent", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10054", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.1 missing authorization on eh_crm_remove_agent AJAX action allows Subscriber+ role removal", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "role-removal"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-10055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:ProjectName", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via ProjectName on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-queue-invoice"}, {"name": "ARGS:timesheet_id", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via timesheet_id on queue-invoice page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-my-dashboard"}, {"name": "ARGS:team_member", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via team_member on my-dashboard page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:notes", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via notes on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10058-01": {"ajax_action": "get_ftp_url", "conditions": [{"name": "ARGS:HostPath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10058", "description": "WP Ultimate CSV Importer <=7.27 authenticated arbitrary file deletion via get_ftp_url AJAX action (HostPath path traversal)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wp-ultimate-csv-importer", "tags": ["arbitrary-file-deletion", "path-traversal", "missing-authorization"], "target": "plugin", "versions": "<=7.27"}, "RULE-CVE-2025-10124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[booking-manager-delete\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10124", "description": "Booking Manager <=2.1.14 unauthorized booking deletion via [booking-manager-delete] shortcode injection in Classic Editor post save", "method": "POST", "mode": "block", "severity": 4.5, "slug": "booking-manager", "tags": ["incorrect-authorization", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-10125-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with script/tag injection (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with javascript: URI (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute event handler injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute script/tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute javascript: URI (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10126-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[mbumap\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-10126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10126", "description": "MyBrain Utilities <=1.0.8 Stored XSS via mbumap shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mybrain-utilities", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2025-10129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10136-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis[\\\\s\\\\S]*?(?:<script|on[a-z0-9_:-]+\\\\s*=|javascript\\\\s*:)[\\\\s\\\\S]*?\\\\[/tweetthis\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10136", "description": "TweetThis Shortcode <=1.8.0 Authenticated (Contributor+) Stored XSS via tweetthis shortcode attributes and content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tweetthis-shortcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2025-10141-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ds\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-10141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10141", "description": "Digiseller <=1.3 Stored XSS via [ds] shortcode attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "digiseller", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10141-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ds\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-10141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10141", "description": "Digiseller <=1.3 Stored XSS via [ds] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "digiseller", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10143-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catch_dark_mode\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/])[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10143", "description": "Catch Dark Mode <=2.0 authenticated (Contributor+) local file inclusion via catch_dark_mode shortcode style attribute in post content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "catch-dark-mode", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-10143-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catch_dark_mode\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/])[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10143", "description": "Catch Dark Mode <=2.0 authenticated (Contributor+) local file inclusion via catch_dark_mode shortcode style attribute in REST API post content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "catch-dark-mode", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-10147-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/podlove/v2/image(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?#]|$)~i"}], "cve": "CVE-2025-10147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10147", "description": "Podlove Podcast Publisher <=4.2.6 unauthenticated arbitrary file upload via REST API image endpoint (url parameter)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "podlove-podcasting-plugin-for-wordpress", "tags": ["arbitrary-file-upload", "unauthenticated", "rest-api", "file-upload"], "target": "plugin", "versions": "<=4.2.6"}, "RULE-CVE-2025-10162-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wooconvo/v1/download-file(/|\\\\?|&|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|(?:^|[\\\\\\\\/])\\\\.htaccess(?:$|[\\\\\\\\/])|(?:^|[\\\\\\\\/])\\\\.env(?:$|[\\\\\\\\/])|(?:^|[\\\\\\\\/])debug\\\\.log(?:$|[\\\\\\\\/])|(?:^|[\\\\\\\\/])error_log(?:$|[\\\\\\\\/])))~i"}], "cve": "CVE-2025-10162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10162", "description": "Admin and Customer Messages After Order for WooCommerce <=13.5 unauthenticated path traversal via REST download-file endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "admin-and-client-message-after-order-for-woocommerce", "tags": ["path-traversal", "local-file-inclusion", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=13.5"}, "RULE-CVE-2025-10163-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*starting_with\\\\s*=\\\\s*([\\"\'])(?:(?:\\\\\\\\.|(?!\\\\1).)*)?(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|UNION\\\\s+(?:ALL\\\\s+)?SELECT|AND\\\\s+\\\\(?\\\\s*SELECT|OR\\\\s+\\\\(?\\\\s*SELECT|INTO\\\\s+(?:OUT|DUMP)FILE)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10163", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10163", "description": "List Category Posts <=0.91.0 authenticated SQL injection via catlist shortcode starting_with attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.5, "slug": "list-category-posts", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-10163-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*starting_with\\\\s*=\\\\s*([\\"\'])(?:(?:\\\\\\\\.|(?!\\\\1).)*)?(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|UNION\\\\s+(?:ALL\\\\s+)?SELECT|AND\\\\s+\\\\(?\\\\s*SELECT|OR\\\\s+\\\\(?\\\\s*SELECT|INTO\\\\s+(?:OUT|DUMP)FILE)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10163", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10163", "description": "List Category Posts <=0.91.0 authenticated SQL injection via catlist shortcode starting_with attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "list-category-posts", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-10166-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:blogger|bookhype|colourlovers|deviantart|dribbble|etsy|facebook|flickr|flipboard|github|goodreads|hackernews|imdb|instagram|lastfm|linkedin|myspace|patreon|pinterest|reddit|slideshare|spacehey|soundcloud|tiktok|twitch|twitter|vimeo|x|yelp|youtube)\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10166", "description": "Social Media Shortcodes <=1.3.1 Stored XSS via shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-media-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-10166-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:blogger|bookhype|colourlovers|deviantart|dribbble|etsy|facebook|flickr|flipboard|github|goodreads|hackernews|imdb|instagram|lastfm|linkedin|myspace|patreon|pinterest|reddit|slideshare|spacehey|soundcloud|tiktok|twitch|twitter|vimeo|x|yelp|youtube)\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10166", "description": "Social Media Shortcodes <=1.3.1 Stored XSS via shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-media-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-10167-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[alg_wc_stock_snapshot_restocked"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[alg_wc_stock_snapshot_restocked\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10167-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "[alg_wc_stock_snapshot_restocked"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[alg_wc_stock_snapshot_restocked\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10181-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[drafts\\\\b[^\\\\]]*template\\\\s*=\\\\s*(?:([\'\\"])(?:(?!\\\\1).)*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)(?:(?!\\\\1).)*\\\\1|[^\\\\s\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10181", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10181", "description": "Draft List <=2.6 authenticated (Contributor+) stored XSS via drafts shortcode template attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-draft-list", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.6"}, "RULE-CVE-2025-10186-01": {"ajax_action": "remove_row", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10186", "description": "WhyDonate <=4.0.15 unauthorized deletion of wp_wdplugin_style rows via remove_row AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-whydonate", "tags": ["missing-authorization", "unauthenticated", "data-deletion"], "target": "plugin", "versions": "<=4.0.15"}, "RULE-CVE-2025-10187-01": {"ajax_action": "wpgsp_apply_ajax_save", "conditions": [{"name": "ARGS:field", "type": "regex", "value": "~(?:[`()=;]|\\\\b(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|SLEEP|IF|FROM|WHERE|OR|AND)\\\\b|--)~i"}], "cve": "CVE-2025-10187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10187", "description": "GSpeech TTS <=3.17.13 authenticated SQL injection via field parameter in wpgsp_apply_ajax_save", "method": "POST", "mode": "block", "severity": 4.9, "slug": "gspeech", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=3.17.13"}, "RULE-CVE-2025-10196-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~surveyanyplace_embed[^]]*(?:on[a-zA-Z]+=|<script|javascript:)~i"}], "cve": "CVE-2025-10196", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10196", "description": "Survey Anyplace <=1.0.0 Stored XSS via surveyanyplace_embed shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "surveyanyplace", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-10196-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~surveyanyplace_embed[^]]*(?:on[a-zA-Z]+=|<script|javascript:)~i"}], "cve": "CVE-2025-10196", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10196", "description": "Survey Anyplace <=1.0.0 Stored XSS via surveyanyplace_embed shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "surveyanyplace", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-10299-01": {"ajax_action": "ctl_create_link", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10299", "mode": "block", "severity": 8.8, "slug": "create-temporary-login", "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-10303-01": {"ajax_action": "owt_lib_handler", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:module", "type": "exists"}, {"name": "ARGS:get_option", "type": "exists"}], "cve": "CVE-2025-10303", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10303", "description": "Library Management System <=3.1 missing authorization on owt_lib_handler AJAX action allows subscriber+ to modify settings and data", "method": "POST", "mode": "block", "severity": 4.3, "slug": "library-management-system", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-10305-01": {"ajax_action": "secure_passkeys_adminarea_passkeys_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_passkeys_list AJAX action allows subscriber+ to view passkeys", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10305-02": {"ajax_action": "secure_passkeys_adminarea_delete_passkey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_delete_passkey AJAX action allows subscriber+ to delete passkeys", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10305-03": {"ajax_action": "secure_passkeys_adminarea_overview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_overview AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10305-04": {"ajax_action": "secure_passkeys_adminarea_filter_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_filter_users AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10305-05": {"ajax_action": "secure_passkeys_adminarea_activate_deactivate_passkey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_activate_deactivate_passkey AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10305-06": {"ajax_action": "secure_passkeys_adminarea_get_profile_registered_passkeys_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_get_profile_registered_passkeys_list AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10305-07": {"ajax_action": "secure_passkeys_adminarea_activity_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10305", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10305", "description": "Secure Passkeys <=1.2.1 missing authorization on adminarea_activity_list AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-passkeys", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-10307-01": {"ajax_action": "backuply_multi_backup_delete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|(?:\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC]|%2[eE]%2[eE]%2[fF]|%2[eE]%2[eE]%5[cC]))~"}], "cve": "CVE-2025-10307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10307", "description": "Backuply <=1.4.8 Authenticated (Admin+) Arbitrary File Deletion via path traversal in backuply_multi_backup_delete AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "backuply", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2025-10307-02": {"ajax_action": "backuply_download_backup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|(?:\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC]|%2[eE]%2[eE]%2[fF]|%2[eE]%2[eE]%5[cC]))~"}], "cve": "CVE-2025-10307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10307", "description": "Backuply <=1.4.8 Authenticated (Admin+) Arbitrary File Read via path traversal in backuply_download_backup AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "backuply", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2025-10309-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via name parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:item", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via item parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:return", "type": "regex", "value": "~(?:<script\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*[^,]*<|<[^>]*\\\\son[a-zA-Z0-9_]+\\\\s*=|[\'\\"]\\\\s*on[a-zA-Z0-9_]+\\\\s*=|expression\\\\s*\\\\()~i"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via return URL parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via coupon parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:email", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via email parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:paypal", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via paypal parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-07": {"action": "init", "conditions": [{"name": "ARGS:paypal_form_coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 reflected XSS via paypal_form_coupon shortcode parameter (unauthenticated)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "reflected-xss", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10310-01": {"ajax_action": "easysnippetGet", "conditions": [{"name": "ARGS:last", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}, {"name": "ARGS:last", "type": "regex", "value": "~(?i)(?:(?:[\'\\\\\\"]\\\\s*)?\\\\b(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER\\\\s+BY|GROUP\\\\s+BY|SLEEP|BENCHMARK|WAITFOR|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\b|(?:--\\\\s*$)|(?:/\\\\*)|(?:;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)))~"}], "cve": "CVE-2025-10310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10310", "description": "Rich Snippet Site Report <=2.0.0105 authenticated SQL injection via last parameter in easysnippetGet AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easysnippet", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.0.0105"}, "RULE-CVE-2025-10375-01": {"ajax_action": "accessibe_add_verification_page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_add_verification_page AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization", "file-creation"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-02": {"ajax_action": "accessibe_modify_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_modify_config AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization", "settings-manipulation"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-03": {"ajax_action": "accessibe_remove_script", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_remove_script AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-04": {"ajax_action": "accessibe_signup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_signup AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-05": {"ajax_action": "accessibe_login", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_login AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10375-06": {"ajax_action": "accessibe_license_trial", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10375", "description": "Web Accessibility By accessiBe <=2.10 CSRF via accessibe_license_trial AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "accessibe", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.10"}, "RULE-CVE-2025-10376-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "crfl_redirect_setting"}, {"name": "ARGS:id", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-10376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10376", "description": "Course Redirects for Learndash <=0.4 CSRF to reflected XSS via unsanitized id parameter on settings page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "course-redirects-for-learndash", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=0.4"}, "RULE-CVE-2025-10380-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on REST API save endpoint - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining with dangerous PHP callables on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on post.php save - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-1043-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in post_content stored through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-1043-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in content stored through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-10476-01": {"ajax_action": "wpfc_db_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10476", "mode": "block", "severity": 4.3, "slug": "wp-fastest-cache", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10487-01": {"ajax_action": "advads_ad_select", "conditions": [{"name": "ARGS:ad_method", "type": "regex", "value": "~^(?!ad$|group$|placement$|id$).+~"}], "cve": "CVE-2025-10487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10487", "description": "Advanced Ads <=2.0.12 unauthenticated limited RCE via ad_method parameter in advads_ad_select AJAX handler", "mode": "block", "severity": 7.3, "slug": "advanced-ads", "tags": ["code-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=2.0.12"}, "RULE-CVE-2025-1054-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~uicore-(?:counter|icon-box|testimonial-(?:slider|grid|carousel))~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[^>]*>|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:[^\\\\s]|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[^>]*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1054", "description": "UiCore Elements <=1.0.16 Stored XSS via Counter/Icon Box/Testimonial widgets on REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uicore-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.16"}, "RULE-CVE-2025-10567-01": {"ajax_action": "get_gutenberg_checkout_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(script|img|svg|iframe|details|embed|object|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|meta|link|style|base|source|applet)[\\\\s/>]|\\\\bon(error|load|click|mouse\\\\w+|focus|blur|toggle|resize|submit|change|input|key\\\\w+|touch\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-10567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10567", "description": "FunnelKit <=3.12.0 reflected XSS via unsanitized checkout text fields in get_gutenberg_checkout_from_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.3, "slug": "funnel-builder", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.12.0"}, "RULE-CVE-2025-10570-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10570", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10570", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.38 missing authorization on fr_refund_request AJAX action allows subscriber+ IDOR refund requests", "method": "POST", "mode": "block", "severity": 4.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.38"}, "RULE-CVE-2025-10579-01": {"ajax_action": "backwpup_working", "conditions": [{"name": "ARGS:jobid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "backwpup"}], "cve": "CVE-2025-10579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10579", "description": "BackWPup <=5.5.0 missing authorization on backwpup_working AJAX action exposes backup filename to low-privilege users", "mode": "block", "severity": 5.3, "slug": "backwpup", "tags": ["missing-authorization", "information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2025-10580-01": {"ajax_action": "widgetopts_ajax_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<[^>]*\\\\bon\\\\w+\\\\s*=|<\\\\s*(?:script|img|svg|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_ajax_settings widget option save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10580-02": {"ajax_action": "widgetopts_migrator", "conditions": [{"name": "ARGS:single_sidebar", "type": "detectXSS"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_migrator single_sidebar parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10582-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wp_dispatch(?:er)?\\\\s+[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\\\\s+\\\\d|AND\\\\s+\\\\d|SLEEP|BENCHMARK|--|;|/\\\\*|\\\\*/|CHAR\\\\s*\\\\(|CONCAT\\\\s*\\\\(|0x[0-9a-fA-F]{2,}|\\\\\\\\x)[^\\"\'\\\\]]*[\\"\']?~i"}], "cve": "CVE-2025-10582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10582", "description": "WP Dispatcher <=1.3.0 authenticated (Contributor+) SQL Injection via wp_dispatch shortcode id attribute in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-dispatcher", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-10582-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dispatch(?:er)?\\\\s+[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\\\\s+\\\\d|AND\\\\s+\\\\d|SLEEP|BENCHMARK|--|;|/\\\\*|\\\\*/|CHAR\\\\s*\\\\(|CONCAT\\\\s*\\\\(|0x[0-9a-fA-F]{2,}|\\\\\\\\x)[^\\"\'\\\\]]*[\\"\']?~i"}], "cve": "CVE-2025-10582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10582", "description": "WP Dispatcher <=1.3.0 authenticated (Contributor+) SQL Injection via wp_dispatch shortcode id attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-dispatcher", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-10586-01": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_venue", "type": "detectSQLi"}], "cve": "CVE-2025-10586", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-10587-01": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_category", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-10587-02": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_venue", "type": "regex", "value": "~^(?!(?:[0-9]*|customuservenue)$)~"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-1063-01": {"ajax_action": "rtcl_taxonomy_settings_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1063", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1063", "description": "Classified Listing <=4.0.4 unauthenticated settings exposure via rtcl_taxonomy_settings_export AJAX action", "mode": "block", "severity": 5.3, "slug": "classified-listing", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1064-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (javascript:/data: URI injection in href)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-1064-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (Gutenberg REST API content field)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-10645-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-reset[/\\\\\\\\](?:.*/)?wf-licensing\\\\.log([?#]|$)~i"}], "cve": "CVE-2025-10645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10645", "description": "WP Reset <=2.05 unauthenticated sensitive information exposure via wf-licensing.log direct file access", "method": "GET", "mode": "block", "severity": 5.3, "slug": "wp-reset", "tags": ["information-disclosure", "sensitive-log-file", "unauthenticated"], "target": "plugin", "versions": "<=2.05"}, "RULE-CVE-2025-10647-01": {"ajax_action": "epdf_wf_download_pdf_media", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.|%2e)(?:ph(?:p\\\\d*|ar|ps|t|tml?)|phtml)(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-10647", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10647", "description": "Embed PDF for WPForms <=1.1.5 arbitrary file upload via dangerous file extension in url parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "embed-pdf-wpforms", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-10649-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^usces_(?:orderlist|memberlist|itemedit)$~"}, {"name": "REQUEST_COOKIES:usces_cookie", "type": "regex", "value": "~(?:sortColumn|sortSwitchs)[^;]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|ORDER\\\\s+BY|AND\\\\s+|OR\\\\s+[\\\\d\\"\\\\\']|[\\\\\'\\\\\\"]\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10649", "description": "Welcart e-Commerce <=2.11.21 authenticated (Author+) SQL injection via usces_cookie sortColumn/sortSwitchs in admin list pages", "method": "GET", "mode": "block", "severity": 6.5, "slug": "usc-e-shop", "tags": ["sql-injection", "cookie-injection", "authenticated"], "target": "plugin", "versions": "<=2.11.21"}, "RULE-CVE-2025-1065-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via type parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:library", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via library parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:date", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via date parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:source", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via source parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via s (search) parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via orderby parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via order parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-10660-01": {"ajax_action": "dashboard_chat", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^(?!(?:[0-9]*|NaN)$)~D"}], "cve": "CVE-2025-10660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10660", "description": "WP Dashboard Chat <=1.0.3 authenticated SQL injection via the id parameter", "mode": "block", "severity": 6.5, "slug": "wp-dashboard-chat", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10679-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/reviewx/api/v1/reviews/bulk/ten/response(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10679", "description": "ReviewX <=2.2.12 unauthenticated limited code execution via bulkTenReviews REST endpoint", "method": "POST", "mode": "block", "severity": 7.3, "slug": "reviewx", "tags": ["code-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.2.12"}, "RULE-CVE-2025-10682-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tariffuxx_configurator[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|EXEC|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+OUTFILE|INTO\\\\s+DUMPFILE)\\\\b|--|#|/\\\\*|\'\\\\s*(?:OR|AND)(?:\\\\s|[\'\\"(]))~i"}], "cve": "CVE-2025-10682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10682", "description": "TARIFFUXX <=1.4 SQL injection via tariffuxx_configurator shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "tariffuxx", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10683-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10683-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10686-01": {"ajax_action": "cretats_get_preview_html", "conditions": [{"name": "ARGS:cretats_layout", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2025-10686", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10686", "description": "Creta Testimonial Showcase <=1.2.3 authenticated Local File Inclusion via cretats_layout parameter in cretats_get_preview_html AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "creta-testimonial-showcase", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-10701-01": {"ajax_action": "etimeclockwp_timeclock_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|math|form)\\\\b~i"}], "cve": "CVE-2025-10701", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10701", "description": "Time Clock <= 1.3.1 Stored XSS via etimeclockwp_timeclock_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "time-clock", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-10745-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]banhammer-process_~"}], "cve": "CVE-2025-10745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10745", "description": "Banhammer <=3.4.8 unauthenticated protection mechanism bypass via predictable banhammer-process_ GET parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "banhammer", "tags": ["protection-bypass", "predictable-secret", "unauthenticated"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-10748-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "rapidresult"}, {"name": "ARGS:s", "type": "regex", "value": "~\'\\\\s*(?:(?:OR|AND)\\\\s+[^\']{0,40}(?:--|#|/[*])|(?:OR|AND)\\\\s+[0-9]+\\\\s*[=<>]|(?:OR|AND)\\\\s*[(]\\\\s*SELECT\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)|SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]~i"}], "cve": "CVE-2025-10748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10748", "description": "RapidResult <=1.2 authenticated (Contributor+) SQL injection via s parameter in admin search", "method": "GET", "mode": "block", "severity": 6.5, "slug": "rapidresult", "tags": ["sql-injection", "authenticated", "admin-search"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10749-01": {"ajax_action": "azure-storage-media-replace", "conditions": [{"name": "ARGS:replace_attachment", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-10749", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10749", "description": "Microsoft Azure Storage for WordPress <=4.5.1 missing authorization on azure-storage-media-replace AJAX action allows authenticated subscribers to delete arbitrary media", "method": "POST", "mode": "block", "severity": 5.4, "slug": "windows-azure-storage", "tags": ["missing-authorization", "broken-access-control", "arbitrary-media-deletion"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-10754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "docodoco-store-locator"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10754", "description": "DocoDoco Store Locator <=1.0.1 authenticated (Editor+) arbitrary file upload via ZIP import", "method": "POST", "mode": "block", "severity": 7.2, "slug": "docodoco-store-locator", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-10862-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via id parameter on PUT /popup/logs REST endpoint", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10862-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:campaignId", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via campaignId parameter on GET /popup/logs REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10873-02": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_email", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_email parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10873-03": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_name", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_name parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10874-01": {"ajax_action": "handle-request-mystock", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://([a-z0-9-]+\\\\.)*static\\\\.?flickr\\\\.com(/|$)).+~i"}], "cve": "CVE-2025-10874", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10874", "description": "Orbit Fox by ThemeIsle <=3.0.1 authenticated SSRF via MyStock image import (handle-request-mystock)", "method": "POST", "mode": "block", "severity": 5.5, "slug": "themeisle-companion", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-10902-01": {"ajax_action": "origaich_ai_scan_result_remove", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10902", "description": "Originality.ai AI Checker <=1.0.15 missing authorization on scan log deletion via origaich_ai_scan_result_remove AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "originality-ai", "tags": ["missing-authorization", "broken-access-control", "data-deletion"], "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2025-10916-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/responses/attachments(?:/|\\\\?|&|$)~"}, {"name": "ARGS:file_token", "type": "regex", "value": "~(?:Li4v|Li5c)~"}], "cve": "CVE-2025-10916", "method": "DELETE", "mode": "block", "severity": 9.1, "slug": "formgent", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-11003-01": {"ajax_action": "uip_save_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_save_ui_template AJAX handler allows Subscriber+ Stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11003-02": {"ajax_action": "uip_create_new_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_create_new_ui_template AJAX handler allows Subscriber+ template creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11007-01": {"ajax_action": "ce21_single_sign_on_save_api_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ce21-suite", "target": "plugin", "versions": ">=2.2.1 <=2.3.1"}, "RULE-CVE-2025-11128-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/feedzy/v1/feed(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~https?://(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?)~i"}], "cve": "CVE-2025-11128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11128", "description": "Feedzy RSS Feeds Lite <=5.1.0 authenticated SSRF via REST API url parameter targeting internal/private IPs", "method": "POST", "mode": "block", "severity": 5.0, "slug": "feedzy-rss-feeds", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2025-11162-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~</style[^>]*>|<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in REST API post meta", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11162-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~</style[^>]*>|<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "classic-editor", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11171-01": {"ajax_action": "ays_chart_admin_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_admin_ajax AJAX handler allowing unauthenticated admin method dispatch", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-02": {"ajax_action": "ays_chart_install_plugin", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_install_plugin AJAX handler allowing unauthenticated plugin installation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-03": {"ajax_action": "ays_chart_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_activate_plugin AJAX handler allowing unauthenticated plugin activation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-05": {"ajax_action": "ays_chart_dismiss_button", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_dismiss_button AJAX handler allowing unauthenticated notice dismissal", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11174-01": {"ajax_action": "dll_load_posts", "conditions": [{"name": "ARGS:args[status]", "type": "regex", "value": "~^(?:draft|pending|future|private|any)$~i"}], "cve": "CVE-2025-11174", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11174", "description": "Document Library Lite <=1.1.6 unauthenticated sensitive information exposure via dll_load_posts AJAX handler args[status] parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "document-library-lite", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-11177-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:log", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}], "cve": "CVE-2025-11177", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11177", "description": "External Login <=1.11.1 unauthenticated SQL injection via log parameter on wp-login.php", "method": "POST", "mode": "block", "severity": 7.5, "slug": "external-login", "tags": ["sql-injection", "unauthenticated", "login-bypass"], "target": "plugin", "versions": "<=1.11.1"}, "RULE-CVE-2025-11185-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cmplz-accept-link\\\\b[^\\\\]]*(?:on[a-z]+=|<script|<img|<svg|<iframe|javascript:|&#(?:x0*22|0*34|x0*27|0*39|x0*3c|0*60|x0*3e|0*62))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11185", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11185", "description": "Complianz GDPR/CCPA Cookie Consent <=7.4.3 Stored XSS via cmplz-accept-link shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "complianz-gdpr", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.3"}, "RULE-CVE-2025-11185-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cmplz-accept-link\\\\b[^\\\\]]*(?:on[a-z]+=|<script|<img|<svg|<iframe|javascript:|&#(?:x0*22|0*34|x0*27|0*39|x0*3c|0*60|x0*3e|0*62))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11185", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11185", "description": "Complianz GDPR/CCPA Cookie Consent <=7.4.3 Stored XSS via cmplz-accept-link shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "complianz-gdpr", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.3"}, "RULE-CVE-2025-11186-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cookies_accepted[^\\\\]]*\\\\].*?(?:<script|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~is"}], "cve": "CVE-2025-11186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11186", "description": "Cookie Notice & Compliance for GDPR/CCPA <=2.5.8 Stored XSS via [cookies_accepted] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cookie-notice", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5.8"}, "RULE-CVE-2025-11186-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cookies_accepted[^\\\\]]*\\\\].*?(?:<script|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~is"}], "cve": "CVE-2025-11186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11186", "description": "Cookie Notice & Compliance for GDPR/CCPA <=2.5.8 Stored XSS via [cookies_accepted] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cookie-notice", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.5.8"}, "RULE-CVE-2025-1119-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/appointments(/|\\\\?|$)~"}, {"name": "ARGS:customer_locale", "type": "regex", "value": "~[^a-zA-Z_\\\\-]~"}], "cve": "CVE-2025-1119", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1119", "description": "Simply Schedule Appointments <=1.6.8.5 unauthenticated arbitrary shortcode execution via stored customer_locale with non-locale characters", "method": "POST", "mode": "block", "severity": 7.3, "slug": "simply-schedule-appointments", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.6.8.5"}, "RULE-CVE-2025-11191-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/realpress/v1/contact-form(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11191", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11191", "description": "RealPress <1.1.0 unauthenticated email sending via /contact-form REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "realpress", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.1.0"}, "RULE-CVE-2025-11191-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/realpress/v1/schedule-tour(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11191", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11191", "description": "RealPress <1.1.0 unauthenticated email sending via /schedule-tour REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "realpress", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.1.0"}, "RULE-CVE-2025-11191-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/realpress/v1/(?!contact-form(/|\\\\?|$)|schedule-tour(/|\\\\?|$))[a-z0-9_/-]+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11191", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11191", "description": "RealPress <1.1.0 unauthenticated page creation and data manipulation via REST API", "method": "POST", "mode": "block", "severity": 5.3, "slug": "realpress", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.1.0"}, "RULE-CVE-2025-11204-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "rm_form_reports"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "GET", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11204-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "rm_form_reports"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "POST", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11204-03": {"ajax_action": "rm_get_stats", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rm_get_stats"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "POST", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11204-04": {"ajax_action": "rm_get_stats", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rm_get_stats"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "GET", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11220-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "text-path"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|link|base)\\\\b|\\\\bon(?:error|load|begin|end|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11220", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11220", "description": "Elementor <=3.33.3 Authenticated (Contributor+) Stored DOM-Based XSS via Text Path widget SVG markup", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elementor", "tags": ["xss", "stored-xss", "svg-injection", "elementor"], "target": "plugin", "versions": "<=3.33.3"}, "RULE-CVE-2025-11227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/campaigns/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated access to single campaign data via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-11227-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/campaigns(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated enumeration of campaigns via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-11227-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/donation-forms/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated access to single donation form data via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-11227-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/donation-forms(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated enumeration of donation forms via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-1123-01": {"ajax_action": "solidwp_mail_send_test_email", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=~i"}], "cve": "CVE-2025-1123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1123", "description": "Solid Mail (WP SMTP) <=2.1.5 stored XSS via test email fields in solidwp_mail_send_test_email AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-smtp", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2025-11254-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via gallery form upload submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11254-03": {"ajax_action": "post_cg_registry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via registry submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11256-01": {"action": "admin_post_nopriv_delete_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file deletion via admin_post_nopriv_delete_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-02": {"action": "admin_post_nopriv_delete_all_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk log deletion via admin_post_nopriv_delete_all_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-03": {"action": "admin_post_nopriv_download_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file download via admin_post_nopriv_download_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-04": {"action": "admin_post_nopriv_fix_permissions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated permission fix via admin_post_nopriv_fix_permissions", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-05": {"action": "admin_post_nopriv_download_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log download via admin_post_nopriv_download_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-06": {"action": "admin_post_nopriv_delete_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log deletion via admin_post_nopriv_delete_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-07": {"action": "admin_post_nopriv_delete_all_widget_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk widget log deletion via admin_post_nopriv_delete_all_widget_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-09": {"ajax_action": "chatbot_chatgpt_upload_files", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated limited file upload via chatbot_chatgpt_upload_files AJAX", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11262-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper/ai-auth(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_id", "type": "regex", "value": "~<\\\\s{0,8}/?\\\\s{0,8}[a-z]|%3c\\\\s{0,8}(?:%2f)?\\\\s{0,8}[a-z]|\\\\bon\\\\w{1,24}\\\\s{0,8}=|javascript\\\\s{0,8}:~i"}], "cve": "CVE-2025-11262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11262", "description": "Link Whisper Free <=0.9.0 unauthenticated stored XSS via the user_id parameter of the ai-auth REST endpoint (POST /wp-json/link-whisper/ai-auth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "link-whisper", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.9.0"}, "RULE-CVE-2025-11271-01": {"action": "init", "conditions": [{"name": "ARGS:verification_override", "type": "exists"}], "cve": "CVE-2025-11271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11271", "description": "Easy Digital Downloads <=3.5.2 PayPal IPN verification bypass via verification_override parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "tags": ["verification-bypass", "unauthenticated", "payment-fraud", "cwe-807"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-11307-01": {"ajax_action": "wpgmza_rest_api_request", "conditions": [{"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via wpgmza_rest_api_request AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11307-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpgmza/v1/~"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via REST API /wpgmza/v1/ endpoints", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11361-01": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~(?:^|[/\\\\\\\\@])(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|localhost|\\\\[::1\\\\])~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - internal/private IP targets", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11361-02": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~^\\\\s*(?:gopher|file|dict|ftp|data|ldap|telnet|tftp|jar|netdoc)\\\\s*:~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - dangerous URL schemes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11369-01": {"ajax_action": "get_instagram_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on get_instagram_access_token AJAX action allows Author+ to read Instagram API token", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-02": {"ajax_action": "google_map_api_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on google_map_api_key AJAX action allows Author+ to read Google Maps API key", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-03": {"ajax_action": "openverse_email_name_DB", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on openverse_email_name_DB AJAX action allows Author+ to read OpenVerse API credentials", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11370-01": {"ajax_action": "depicter-document-rules-store", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule update via depicter-document-rules-store AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11370-02": {"ajax_action": "depicter-document-rules-show", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule read via depicter-document-rules-show AJAX action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11372-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "lp/v1/admin/tools/create-indexs"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11372", "description": "LearnPress \\u2013 WordPress LMS Plugin Admin Tools REST create-indexs endpoint is exposed without authorization because it is registered with permission_callback set to __return_true, allowing unauthenticated destructive database operations (dropping indexes on any table including wp_options, creating duplicate configuration entries, and degrading performance) via /wp-json/lp/v1/admin/tools/create-indexs when table names are supplied.", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "tags": ["missing-authorization", "rest-api", "unauthenticated", "database-manipulation"], "target": "plugin", "versions": "<=4.2.9.3"}, "RULE-CVE-2025-11377-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11377-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute (REST API)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass", "rest-api"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\/wp-content\\\\/webp-express\\\\/config\\\\/.*\\\\.json~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11379", "description": "WebP Express <=0.25.9 unauthenticated information disclosure via predictable config.json file path", "method": "GET", "mode": "block", "severity": 5.3, "slug": "webp-express", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=0.25.9"}, "RULE-CVE-2025-11380-01": {"ajax_action": "everest_process_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_process_status AJAX action leading to unauthenticated backup file location disclosure", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11380-02": {"ajax_action": "everest_backup_process_status_unlink", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_backup_process_status_unlink AJAX action allowing unauthenticated status file deletion", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "data-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11427-01": {"ajax_action": "wpmdb_flush", "conditions": [{"name": "ARGS:download", "type": "regex", "value": "~(?:https?|ftp|file|php|data|phar|compress\\\\.(?:zlib|bzip2)|zip|glob|expect)://~i"}], "cve": "CVE-2025-11427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11427", "description": "WP Migrate Lite <=2.7.6 unauthenticated blind SSRF via wpmdb_flush AJAX download parameter", "method": "POST", "mode": "block", "severity": 5.8, "slug": "wp-migrate-db", "tags": ["ssrf", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2025-11448-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envira-convert/v1/bulk-convert(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11448", "description": "Envira Gallery Lite <=1.11.0 missing authorization on bulk-convert REST endpoint", "method": "POST", "mode": "block", "severity": 4.3, "slug": "envira-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2025-11451-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/aal_ajax_unit_loading(/|\\\\?|&|$)~"}, {"name": "ARGS:data[template_path]", "type": "exists"}], "cve": "CVE-2025-11451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11451", "description": "Auto Amazon Links <=5.4.3 unauthenticated arbitrary file read via template_path in REST API", "mode": "block", "severity": 7.5, "slug": "amazon-auto-links", "target": "plugin", "versions": "<=5.4.3"}, "RULE-CVE-2025-11453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:_inpost_head_script[synth_header_script]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11453", "description": "Header and Footer Scripts <=2.2.2 Stored XSS via _inpost_head_script post meta field by Contributor+ users", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-scripts", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-11454-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "eos_scfm_duplicate_post_as_draft"}, {"name": "ARGS:post", "type": "regex", "value": "~[^0-9]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11454", "description": "Specific Content For Mobile <=0.5.5 authenticated SQL injection via post parameter in eos_scfm_duplicate_post_as_draft admin action", "method": "GET", "mode": "block", "severity": 6.5, "slug": "specific-content-for-mobile", "tags": ["sql-injection", "authenticated", "contributor"], "target": "plugin", "versions": "<=0.5.5"}, "RULE-CVE-2025-11457-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/easycommerce/v1/orders(?:/|[?&]|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-11457", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easycommerce", "target": "plugin", "versions": ">=0.9.0-beta2 <=1.8.2"}, "RULE-CVE-2025-11496-01": {"action": "init", "conditions": [{"name": "ARGS:rtb-name", "type": "detectXSS"}], "cve": "CVE-2025-11496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11496", "description": "Five Star Restaurant Reservations <=2.7.5 unauthenticated stored XSS via rtb-name booking form parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "restaurant-reservations", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-11499-01": {"action": "init", "conditions": [{"name": "ARGS:post_featured_image", "type": "regex", "value": "~https?://[^\\\\s\\"\'<>]+\\\\.(?:ph(?:p\\\\d?|ps|tml?|t|ar)|[aj]sp[x]?|cgi|cfm|exe|bash)(?:[?#]|$)~i"}], "cve": "CVE-2025-11499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tablesome", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-11502-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[saswp_tiny_multiple_faq\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11502", "description": "Schema & Structured Data for WP & AMP <=1.51 Stored XSS via saswp_tiny_multiple_faq shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.51"}, "RULE-CVE-2025-11502-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[saswp_tiny_multiple_faq\\\\b[^\\\\]]*(?:<svg|<iframe|<embed|<object|<math|<body|<video[^>]*autoplay|<img[^>]*(?:onerror|onload|onsrc)\\\\s*=)~i"}], "cve": "CVE-2025-11502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11502", "description": "Schema & Structured Data for WP & AMP <=1.51 Stored XSS via saswp_tiny_multiple_faq shortcode dangerous HTML elements in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.51"}, "RULE-CVE-2025-11504-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]plugins[/\\\\\\\\]quickcreator[/\\\\\\\\]dupasrala\\\\.txt~i"}], "cve": "CVE-2025-11504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11504", "description": "Quickcreator <=0.1.17 unauthenticated sensitive API key exposure via dupasrala.txt static file", "method": "GET", "mode": "block", "severity": 7.5, "slug": "quickcreator", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "cwe-532"], "target": "plugin", "versions": "<=0.1.17"}, "RULE-CVE-2025-11510-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/v1/fb-wipe-clear-all-data(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11510", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11510", "description": "FileBird <=6.4.9 missing authorization on fb-wipe-clear-all-data REST endpoint allows author+ to reset plugin data", "method": "POST", "mode": "block", "severity": 4.3, "slug": "filebird", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=6.4.9"}, "RULE-CVE-2025-11536-01": {"ajax_action": "import_elementor_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_elementor_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11536-02": {"ajax_action": "import_ep_elementor_bundle_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_ep_elementor_bundle_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11564-01": {"ajax_action": "tutor_handle_api_calls", "conditions": [{"name": "ARGS:payment_type", "type": "equals", "value": "recurring"}], "cve": "CVE-2025-11564", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11564", "description": "Tutor LMS <=3.8.3 unauthenticated payment verification bypass via forged recurring payment webhook", "method": "POST", "mode": "block", "severity": 5.3, "slug": "tutor", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2025-11576-01": {"ajax_action": "newcodebyte_chatbot_send_message", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~^\\\\s*[=+\\\\-@]~"}], "cve": "CVE-2025-11576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11576", "description": "AI Chatbot Free Models <=1.6.5 unauthenticated CSV injection via chat message", "method": "POST", "mode": "block", "severity": 4.3, "slug": "chatbot-ai-free-models", "tags": ["csv-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-11587-01": {"action": "admin_post_cnb_apikey_activate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11587", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11587", "description": "Call Now Button <=1.5.3 missing authorization on API key activation via admin_post_cnb_apikey_activate", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2025-11627-01a": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (message)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01b": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01c": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error_msg", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error_msg)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11632-01": {"ajax_action": "cnb_get_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-02": {"ajax_action": "cnb_request_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_request_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-03": {"ajax_action": "cnb_create_chat_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_create_chat_token AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-04": {"ajax_action": "cnb_get_domain_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_domain_status AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-05": {"ajax_action": "cnb_get_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-06": {"ajax_action": "cnb_get_agency_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_agency_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-07": {"ajax_action": "cnb_upgrade_to_yearly", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_upgrade_to_yearly AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-08": {"ajax_action": "cnb_enable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_enable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-09": {"ajax_action": "cnb_disable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_disable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-10": {"ajax_action": "cnb_get_plans", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_plans AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-11": {"ajax_action": "cnb_time_format", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_time_format AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11691-01": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:ppom_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via ppom_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11691-02": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:productmeta_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via productmeta_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php path traversal", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11692-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php targeting sensitive files", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11703-01": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~<[a-z!/][^>]*>~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - HTML tag injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-02": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - DOM event handler injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-03": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - javascript URI injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11705-01": {"ajax_action": "GOTMLS_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 authenticated arbitrary file read via GOTMLS_scan AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-02": {"ajax_action": "GOTMLS_View_Quarantine", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_View_Quarantine AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-03": {"ajax_action": "GOTMLS_load_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_load_update AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-04": {"ajax_action": "GOTMLS_empty_trash", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_empty_trash AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-05": {"ajax_action": "GOTMLS_whitelist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_whitelist AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-06": {"ajax_action": "GOTMLS_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_fix AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11706-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "aruba-hispeed-cache"}, {"name": "ARGS:dbstatus", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-11706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11706", "description": "Aruba HiSpeed Cache <=3.0.2 reflected cross-site scripting via dbstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "aruba-hispeed-cache", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-01": {"ajax_action": "ahsc_reset_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on plugin settings AJAX endpoints", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-02": {"ajax_action": "ahsc_enable_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_purge AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-03": {"ajax_action": "ahsc_enable_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_cron AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-04": {"ajax_action": "ahsc_debug_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on debug_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-05": {"ajax_action": "ahsc_xmlrpc_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on xmlrpc_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-06": {"ajax_action": "ahsc_cron_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-07": {"ajax_action": "ahsc_cron_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_time AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-08": {"ajax_action": "ahsc_dboptimization", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dboptimization AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-09": {"ajax_action": "ahsc_purge_homepage_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_homepage_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-10": {"ajax_action": "ahsc_purge_archive_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_archive_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-11": {"ajax_action": "ahsc_purge_page_on_new_comment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_page_on_new_comment AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-12": {"ajax_action": "ahsc_static_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on static_cache AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-13": {"ajax_action": "ahsc_lazy_load", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on lazy_load AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-14": {"ajax_action": "ahsc_html_optimizer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on html_optimizer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-15": {"ajax_action": "ahsc_dns_preconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-16": {"ajax_action": "ahsc_dns_preconnect_domain_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect_domain_list AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-17": {"ajax_action": "ahsc_cache_warmer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cache_warmer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-18": {"ajax_action": "ahsc_update_apc_Settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on update_apc_Settings AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-19": {"ajax_action": "ahsc_check_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on check_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-20": {"ajax_action": "ahsc_create_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on create_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-21": {"ajax_action": "ahsc_delete_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on delete_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11726-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to create/update global presets", "method": "POST", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11726-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to delete global presets", "method": "DELETE", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11733-01": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:pre_footnotes", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via pre_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11733-02": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_footnotes", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via post_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11734-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:^/wp-json)(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post|(?:^|&|\\\\?)rest_route=(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post)(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-11734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11734", "description": "Broken Link Checker by AIOSEO <=1.2.5 missing authorization on DELETE /aioseoBrokenLinkChecker/v1/post allows contributor+ to trash arbitrary posts", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "broken-link-checker-seo", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-11745-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[adinserter[^\\\\]]*custom-field\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11745", "description": "Ad Inserter <=2.8.7 Stored XSS via [adinserter custom-field] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-inserter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.7"}, "RULE-CVE-2025-11749-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/messages~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11749-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/sse~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11754-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gdpr/v1/settings(?:/)?(?:\\\\?|$)~"}, {"name": "ARGS:platform", "type": "equals", "value": "wordpress"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11754", "description": "GDPR Cookie Consent <=4.1.2 unauthenticated information disclosure via gdpr/v1/settings REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-11755-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipes(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipes", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipe_fields(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipe_fields", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11758-01": {"ajax_action": "aio_time_clock_lite_admin_js", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11758", "description": "All in One Time Clock Lite <=2.0.3 missing authorization on admin AJAX handler allowing unauthenticated page creation and report download", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aio-time-clock-lite", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-11765-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stock[-_]tools)\\\\b[^\\\\]]*\\\\bimage_width\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<script\\\\b|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\"\'\\\\]]*[\\"\'][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11765", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11765", "description": "Stock Tools <=1.1 authenticated (Contributor+) stored XSS via image_width shortcode attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-tools", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-11770-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[brighttalk-time\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<script|<img|<svg|<iframe|<object|<embed|<video|<audio|<math|<details|on(?:error|load|click|mouseover|focus|blur|mouse(?:enter|leave|move|out|up|down))\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11770", "description": "BrightTALK WordPress Shortcode <=2.4.0 Stored XSS via brighttalk-time shortcode format attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brighttalk-wp-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-11770-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[brighttalk-time\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<script|<img|<svg|<iframe|<object|<embed|<video|<audio|<math|<details|on(?:error|load|click|mouseover|focus|blur|mouse(?:enter|leave|move|out|up|down))\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11770", "description": "BrightTALK WordPress Shortcode <=2.4.0 Stored XSS via brighttalk-time shortcode format attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brighttalk-wp-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-11771-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tokenico/v1/create-sale-record(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11771", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11771", "description": "TokenICO <=2.4.7 unauthenticated presale counter manipulation via create-sale-record REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop", "tags": ["missing-authentication", "unauthorized-data-modification", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-11799-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[affiai_img\\\\b[^\\\\]]*asin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11799", "description": "Affiliate AI Lite <=1.0.1 Stored XSS via affiai_img shortcode asin attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-ai-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11799-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[affiai_img\\\\b[^\\\\]]*asin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11799", "description": "Affiliate AI Lite <=1.0.1 Stored XSS via affiai_img shortcode asin attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-ai-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11799-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[affiai_img\\\\b[^\\\\]]*asin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11799", "description": "Affiliate AI Lite <=1.0.1 Stored XSS via affiai_img shortcode asin attribute in post content (REST API update via PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "affiliate-ai-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11800-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[minicrm\\\\b[^\\\\]]*id\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:<|javascript\\\\s*:|on\\\\w+\\\\s*=)[^\\"\']*[\\"\']|[^\\\\s\\\\]\\\\\\"\']*(?:<|javascript\\\\s*:|on\\\\w+\\\\s*=)[^\\\\s\\\\]\\\\\\"\']*)~i"}], "cve": "CVE-2025-11800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11800", "description": "Surbma | MiniCRM Shortcode <=2.0 Stored XSS via minicrm shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "surbma-minicrm-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-11803-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpsite_y\\\\b[^\\\\]]*\\\\bformat\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y shortcode format attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor shortcode before attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_y\\\\b[^\\\\]]*\\\\bformat\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y format attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor before attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11805-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[skipto\\\\b[^\\\\]]*(?:(?:time|text|class)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|javascript\\\\s*:)|\\\\bon\\\\w+\\\\s*=\\\\s*[\\"\'])[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-11805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11805", "description": "Skip to Timestamp <=1.4.4 Stored XSS via skipto shortcode time/text/class attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "skip-to-timestamp", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-11806-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "[qzzr "}, {"name": "ARGS:post_content", "type": "regex", "value": "~quiz[ ]*=[ ]*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11806", "description": "Qzzr Shortcode <=1.0.1 Stored XSS via [qzzr] shortcode quiz attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qzzr-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11806-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[qzzr "}, {"name": "ARGS:content", "type": "regex", "value": "~quiz[ ]*=[ ]*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11806", "description": "Qzzr Shortcode <=1.0.1 Stored XSS via [qzzr] shortcode quiz attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qzzr-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11810-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[print-button\\\\b[^\\\\]]*target\\\\s*=\\\\s*[\'\\"][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|img|svg|iframe|object|embed))~i"}], "cve": "CVE-2025-11810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11810", "description": "Print Button Shortcode <=1.0.1 authenticated stored XSS via [print-button] shortcode target attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "print-button-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11810-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[print-button\\\\b[^\\\\]]*target\\\\s*=\\\\s*[\'\\"][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|img|svg|iframe|object|embed))~i"}], "cve": "CVE-2025-11810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11810", "description": "Print Button Shortcode <=1.0.1 authenticated stored XSS via [print-button] shortcode target attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "print-button-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11811-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embed_youtube\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']|(?![\\"\'])\\\\S*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)\\\\S*)~i"}], "cve": "CVE-2025-11811", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11811", "description": "Simple Youtube Shortcode <=1.1.3 Stored XSS via embed_youtube shortcode id attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-youtube-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2025-11811-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[embed_youtube\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']|(?![\\"\'])\\\\S*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)\\\\S*)~i"}], "cve": "CVE-2025-11811", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11811", "description": "Simple Youtube Shortcode <=1.1.3 Stored XSS via embed_youtube shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-youtube-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2025-11813-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[responsive_map\\\\b[^\\\\]]*(?:width|height)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\']*\')~i"}], "cve": "CVE-2025-11813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11813", "description": "Responsive iframe GoogleMap <=1.0.2 stored XSS via responsive_map shortcode width/height attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-iframe-googlemap", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11813-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[responsive_map\\\\b[^\\\\]]*(?:width|height)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\']*\')~i"}], "cve": "CVE-2025-11813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11813", "description": "Responsive iframe GoogleMap <=1.0.2 stored XSS via responsive_map shortcode width/height attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-iframe-googlemap", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11816-01": {"ajax_action": "disconnect_account_request", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11816", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wplegalpages", "target": "plugin", "versions": "<=3.5.0"}, "RULE-CVE-2025-11818-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:wprm_team|Team-manager)\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11818", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11818", "description": "WP Responsive Meet The Team <=1.0.1 stored XSS via shortcode attributes in post content (post editor save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-responsive-meet-the-team", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11818-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wprm_team|Team-manager)\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11818", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11818", "description": "WP Responsive Meet The Team <=1.0.1 stored XSS via shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-responsive-meet-the-team", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11820-03": {"ajax_action": "graphina_setting_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<img[^>]*\\\\bon|<iframe[\\\\s>]~i"}], "cve": "CVE-2025-11820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11820", "description": "Graphina - Elementor Charts and Graphs <=3.1.8 admin settings Stored XSS via graphina_setting_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-11821-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:<script|<iframe|<svg|<img[^>]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:post_content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:<script|<iframe|<svg|<img[^>]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:<script|<iframe|<svg|<img[^>]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11822-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bootstrap_tab\\\\b[^\\\\]]*(?:name|link|active)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\\"|\'[^\']*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11822", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11822", "description": "WP Bootstrap Tabs <=1.0.4 Stored XSS via [bootstrap_tab] shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bootstrap-tabs", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-11822-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bootstrap_tab\\\\b[^\\\\]]*(?:name|link|active)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\\"|\'[^\']*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11822", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11822", "description": "WP Bootstrap Tabs <=1.0.4 Stored XSS via [bootstrap_tab] shortcode attributes in REST API content submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bootstrap-tabs", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-11823-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_exist_text\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_exist_text attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_exist_text\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_exist_text attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ever_compare\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via ever_compare shortcode button_text attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ever_compare\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via ever_compare shortcode button_text attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-05": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_text/button_added_text attributes (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_text/button_added_text attributes (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11826-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[social-networks\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(on(mouseover|click|error|focus|load|keydown|keyup|mouseout|mouseenter|submit|change|input)\\\\s*=|<\\\\s*(script|img|iframe|svg|object|embed|link|style|body|input|form|video|audio|details|marquee)|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11826", "description": "WP Company Info <=1.9.0 Stored XSS via [social-networks] shortcode class attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-company-info", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11826-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[social-networks\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(on(mouseover|click|error|focus|load|keydown|keyup|mouseout|mouseenter|submit|change|input)\\\\s*=|<\\\\s*(script|img|iframe|svg|object|embed|link|style|body|input|form|video|audio|details|marquee)|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11826", "description": "WP Company Info <=1.9.0 Stored XSS via [social-networks] shortcode class attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-company-info", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11827-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "[oboxads-ad-widget"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oboxads-ad-widget\\\\b[^\\\\]]*(?:before_widget|after_widget|before_title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<img|<svg|<iframe|<object|<embed|<link|<style|on(?:error|load|click|mouseover|focus|blur|change|submit|input|keydown|keyup|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11827", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11827", "description": "Oboxmedia Ads <=1.9.8 Stored XSS via oboxads-ad-widget shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "oboxmedia-ads", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-11827-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[oboxads-ad-widget"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oboxads-ad-widget\\\\b[^\\\\]]*(?:before_widget|after_widget|before_title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<img|<svg|<iframe|<object|<embed|<link|<style|on(?:error|load|click|mouseover|focus|blur|change|submit|input|keydown|keyup|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11827", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11827", "description": "Oboxmedia Ads <=1.9.8 Stored XSS via oboxads-ad-widget shortcode attributes in REST post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "oboxmedia-ads", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-11828-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:bnm-blocks/(?:featured-posts-1|featured-posts-2|slider|post-block-1|post-block-2|posts-ultra)\\\\s[\\\\s\\\\S]*?\\"(?:headerHtmlTag|titleHtmlTag)\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s=][^\\"]*\\"~i"}], "cve": "CVE-2025-11828", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11828", "description": "Magazine Companion (bnm-blocks) <=1.2.3 Stored XSS via headerHtmlTag/titleHtmlTag block attributes in REST API post creation", "mode": "block", "severity": 6.4, "slug": "bnm-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-11828-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:bnm-blocks/(?:featured-posts-1|featured-posts-2|slider|post-block-1|post-block-2|posts-ultra)\\\\s[\\\\s\\\\S]*?\\"(?:headerHtmlTag|titleHtmlTag)\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s=][^\\"]*\\"~i"}], "cve": "CVE-2025-11828", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11828", "description": "Magazine Companion (bnm-blocks) <=1.2.3 Stored XSS via headerHtmlTag/titleHtmlTag block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bnm-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-11829-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[five9-chat\\\\b[^\\\\]]*toolbar\\\\s*=\\\\s*[\\"\'][^\\\\]]*(<script|on(error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11829", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11829", "description": "Five9 Live Chat <=1.1.2 authenticated (Contributor+) stored XSS via [five9-chat] shortcode toolbar attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "five9", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11830-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[restaurant_summary\\\\b[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|\\\\bon[a-z]+=|javascript:|style\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11830", "description": "WP Restaurant Listings <=1.0.2 Stored XSS via restaurant_summary shortcode align attribute in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-restaurant-listings", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11830-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[restaurant_summary\\\\b[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|\\\\bon[a-z]+=|javascript:|style\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11830", "description": "WP Restaurant Listings <=1.0.2 Stored XSS via restaurant_summary shortcode align attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-restaurant-listings", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11841-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "greenshift-blocks/chart"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<script[\\\\s>]|</script|\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11841", "description": "Greenshift \\u2013 animation and page builder blocks <=12.2.7 Stored XSS via Chart Data Attributes in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=12.2.7"}, "RULE-CVE-2025-11857-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mxp_fb2wp_display_embed\\\\b[^\\\\]]*\\\\bpost_id\\\\s*=\\\\s*(?:\\"(?!\\\\d+(?:_\\\\d+)?\\")([^\\"]*)\\"|\'(?!\\\\d+(?:_\\\\d+)?\')([^\']*)\'|(?!\\\\d+(?:_\\\\d+)?(?:\\\\s|\\\\]|$))([^\\\\s\\\\]\'\\\\\\"]+))~i"}], "cve": "CVE-2025-11857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11857", "description": "FB2WP Integration Tools <=1.9.9 Stored XSS via mxp_fb2wp_display_embed shortcode post_id attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fb2wp-integration-tools", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2025-11857-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mxp_fb2wp_display_embed\\\\b[^\\\\]]*\\\\bpost_id\\\\s*=\\\\s*(?:\\"(?!\\\\d+(?:_\\\\d+)?\\")([^\\"]*)\\"|\'(?!\\\\d+(?:_\\\\d+)?\')([^\']*)\'|(?!\\\\d+(?:_\\\\d+)?(?:\\\\s|\\\\]|$))([^\\\\s\\\\]\'\\\\\\"]+))~i"}], "cve": "CVE-2025-11857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11857", "description": "FB2WP Integration Tools <=1.9.9 Stored XSS via mxp_fb2wp_display_embed shortcode post_id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fb2wp-integration-tools", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2025-11863-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[mygeo_(?:city|country_code|country_name|region|latitude|longitude|postal_code)\\\\b[^\\\\]]*default\\\\s*=\\\\s*[\'\\"]?[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11863", "description": "My Geo Posts Free <=1.2 Stored XSS via mygeo_* shortcode default attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-geo-posts-free", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11863-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mygeo_(?:city|country_code|country_name|region|latitude|longitude|postal_code)\\\\b[^\\\\]]*default\\\\s*=\\\\s*[\'\\"]?[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11863", "description": "My Geo Posts Free <=1.2 Stored XSS via mygeo_* shortcode default attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-geo-posts-free", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11872-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post\\\\.php|post-new\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mdiconic\\\\b[^\\\\]]*(?:\\\\s+on[a-z]+\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s*(?:style|class)\\\\s*=)~i"}], "cve": "CVE-2025-11872", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11872", "description": "Material Design Iconic Font Integration <=2 Stored XSS via [mdiconic] shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "material-design-iconic-font-integration", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2"}, "RULE-CVE-2025-11872-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mdiconic\\\\b[^\\\\]]*(?:\\\\s+on[a-z]+\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s*(?:style|class)\\\\s*=)~i"}], "cve": "CVE-2025-11872", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11872", "description": "Material Design Iconic Font Integration <=2 Stored XSS via [mdiconic] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "material-design-iconic-font-integration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2"}, "RULE-CVE-2025-11873-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[url\\\\s*=\\\\s*(?:javascript|vbscript|data)\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11873", "description": "WP BBCode <=1.8.1 authenticated (Contributor+) Stored XSS via [url] BBCode shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bbcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.1"}, "RULE-CVE-2025-11873-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[url\\\\s*=[^\\\\]]*[\\"\']\\\\s*on\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11873", "description": "WP BBCode <=1.8.1 authenticated (Contributor+) Stored XSS via [url] BBCode attribute injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bbcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.1"}, "RULE-CVE-2025-11873-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[url[^\\\\]]*\\\\][^\\\\[]*<\\\\s*(?:script|img|svg|iframe|object|embed|details|marquee|math|body|input|form|link|meta|style|base)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11873", "description": "WP BBCode <=1.8.1 authenticated (Contributor+) Stored XSS via HTML injection in [url] BBCode inner text", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bbcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.1"}, "RULE-CVE-2025-11876-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mailgun_subscription_form\\\\b[^\\\\]]*(?:<(?:script|svg|iframe|embed|object|math|details|img|video|audio|body|input|select|textarea|button|form|link|style|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|change|input|submit|pointerover|mouseenter|dblclick|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11876", "description": "Mailgun Subscriptions <=1.3.1 Stored XSS via mailgun_subscription_form shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mailgun-subscriptions", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-11881-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/myappp-verify(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via myappp-verify REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11881-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/system-info(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via system-info REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11917-01": {"ajax_action": "wpematico_test_feed", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp)://|://(?:localhost|\\\\[?::1\\\\]?|0x[0-9a-f]|0[0-7]{2,}|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.)|://[^/?#]*@)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11917", "description": "WPeMatico RSS Feed Fetcher <=2.8.11 authenticated (Subscriber+) SSRF via wpematico_test_feed AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpematico", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2025-11923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/students/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11923-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/instructors/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?forms/\\\\d+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated IDOR on ninja-forms-views REST submissions endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["idor", "missing-authorization", "unauthenticated", "rest-api", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11924-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?token/refresh(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated bearer token minting via ninja-forms-views REST token/refresh endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "rest-api", "token-minting"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11928-01": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_set_property AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11928-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_create AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11976-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fusewp_save_sync_rule", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11976", "description": "FuseWP <=1.1.23.0 CSRF to sync rule creation/edit via missing nonce and capability check on save_changes()", "method": "POST", "mode": "block", "severity": 4.3, "slug": "fusewp", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23.0"}, "RULE-CVE-2025-11986-01": {"ajax_action": "crypto_connect_ajax_process", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-11986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11986", "description": "Crypto plugin <=2.22 unauthenticated auth bypass and data injection via crypto_connect_ajax_process AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "crypto", "tags": ["missing-authentication", "authentication-bypass", "unauthenticated", "information-exposure"], "target": "plugin", "versions": "<=2.22"}, "RULE-CVE-2025-11987-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11987-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/)?(?:\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11994-01": {"action": "init", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-11994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11994", "description": "Easy Email Subscription <=1.3 unauthenticated stored XSS via subscription form name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "email-subscription-with-secure-captcha", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-11995-01": {"action": "init", "conditions": [{"name": "ARGS:eventdesc", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event description field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-02": {"action": "init", "conditions": [{"name": "ARGS:eventname", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event name field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-03": {"action": "init", "conditions": [{"name": "ARGS:eventaddress", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-04": {"action": "init", "conditions": [{"name": "ARGS:eventticket", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event ticket address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-05": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:year", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via year parameter in community_events_frontend_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-06": {"ajax_action": "community_events_admin_list", "conditions": [{"name": "ARGS:currentyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via currentyear parameter in community_events_admin_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-07": {"ajax_action": "community_events_click_tracker", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via id parameter in community_events_click_tracker AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11999-01": {"ajax_action": "addmultiplemarker_reset_map", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated map reset via addmultiplemarker_reset_map AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "data-deletion"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11999-02": {"ajax_action": "amm_save_map_api", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated API key overwrite via amm_save_map_api AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "settings-manipulation"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-12000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpfunnels/v1/settings(/|\\\\?|&|$)~"}, {"name": "ARGS:logKey", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e|%252e%252e)[%/\\\\\\\\]|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])(?:debug\\\\.log|error_log)(?:$|[\\\\\\\\/])))~i"}], "cve": "CVE-2025-12000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12000", "description": "WPFunnels <=3.6.2 authenticated arbitrary file deletion via path traversal in logKey parameter on REST settings endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpfunnels", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated (Contributor+) sensitive information exposure via {al:*} shortcode placeholders in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-02": {"ajax_action": "update_authors_list_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 unauthenticated sensitive information exposure via update_authors_list_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-03": {"ajax_action": "authors_list_display_edit_item_preview_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated sensitive information exposure via authors_list_display_edit_item_preview_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12018-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fnd]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fnd] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[rsp]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[rsp] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mol]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mol] member login message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moe]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moe] membership expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mon]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mon] no-access message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moi]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moi] session expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[org]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[org] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[out]", "type": "regex", "value": "~(?:javascript\\\\s*:|\\"\\\\s*(?:on\\\\w+\\\\s*=|>)|<\\\\s*(?:script|img|svg|iframe))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[out] logout redirect URL", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[top]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[top] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fbk]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fbk] Facebook App ID attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[map]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[map] Google Maps API key attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12021-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on wp-login.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12021-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~login-google\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on login-google.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12025-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_ytcs_title]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via title setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12025-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_youtube_channel_id]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>]|\\"|\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via channel ID setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12028-01": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization POST confirmation via wp-login.php?action=indieauth", "method": "POST", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-02": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization GET initiation via wp-login.php?action=indieauth", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/indieauth/1\\\\.0/auth(?:/|\\\\?|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/indieauth/1\\\\.0/auth(?:/|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (rest_route=/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12032-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_messager", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized messager setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_zalo", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized zalo setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_hotline", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized hotline setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_contact", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized contact setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12034-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][domain]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN domain settings field (domain key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12034-02": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][url]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN url settings field (legacy url key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]course-booking-system[/\\\\\\\\](includes[/\\\\\\\\])?csv-export\\\\.php([?#]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12042", "description": "Course Booking System <=6.1.5 unauthenticated booking data export via direct access to csv-export.php", "method": "GET", "mode": "block", "severity": 5.3, "slug": "course-booking-system", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-12045-01": {"ajax_action": "add-tag", "conditions": [{"name": "ARGS:tag-name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via taxonomy term name in add-tag AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/tags(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via tag name through REST /wp/v2/tags endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/categories(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via category name through REST /wp/v2/categories endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12062-01": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_name parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12062-02": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_type parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12064-01": {"ajax_action": "xyz_fbap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12064-02": {"ajax_action": "xyz_fbap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpedpcampaign"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|(?:src|href|action)\\\\s*=\\\\s*[\\"\']?javascript:|xmlns)|<\\\\s*(?:script|iframe|object|embed|svg|math)~i"}], "cve": "CVE-2025-12066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12066", "description": "WP Delete Post Copies <=6.0.2 stored XSS via campaign meta box fields on save_post", "method": "POST", "mode": "block", "severity": 4.4, "slug": "etruel-del-post-copies", "tags": ["xss", "stored-xss", "admin-plus"], "target": "plugin", "versions": "<=6.0.2"}, "RULE-CVE-2025-12067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via table cell content in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via REST API post update with table cell content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12076-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via ln_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:th_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via th_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:tw_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via tw_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:xyz_smap_bot_token", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyz_smap_bot_token parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-05": {"ajax_action": "xyz_smap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-06": {"ajax_action": "xyz_smap_del_ln_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ln_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-07": {"ajax_action": "xyz_smap_del_tw_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_tw_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-08": {"ajax_action": "xyz_smap_del_ig_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ig_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-09": {"ajax_action": "xyz_smap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-10": {"ajax_action": "xyz_smap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-11": {"ajax_action": "xyz_smap_del_twuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_twuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-12": {"ajax_action": "xyz_smap_del_iguser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_iguser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12077-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedin-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via ln_auth_err parameter on plugin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-02": {"ajax_action": "xyz_lnap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-03": {"ajax_action": "xyz_lnap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12089-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache()", "method": "POST", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12089-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "supsystic-tables"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache() (GET admin page)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12092-01-0": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[0]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-1": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[1]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-2": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[2]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-3": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[3]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-4": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[4]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12099-01": {"ajax_action": "academy/course/import_all_courses", "conditions": [{"name": "ARGS:import_all_courses", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-12099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12099", "description": "Academy LMS <=3.3.8 authenticated PHP Object Injection via import_all_courses AJAX action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "academy", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2025-12109-01": {"action": "init", "conditions": [{"name": "ARGS:asm_header_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_header_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-02": {"action": "init", "conditions": [{"name": "ARGS:asm_body_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_body_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-03": {"action": "init", "conditions": [{"name": "ARGS:asm_footer_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_footer_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12115-01": {"action": "init", "conditions": [{"name": "ARGS:add-to-cart", "type": "exists"}, {"name": "ARGS:woonp", "type": "exists"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/\\\\?|\\\\?|&)(?:add-to-cart=)~"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in add-to-cart POST", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12115-02": {"action": "init", "conditions": [{"name": "ARGS:woonp", "type": "exists"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in GET request", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12126-01": {"ajax_action": "ttbp_add_chapter", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to add chapters to others\' books via ttbp_add_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-02": {"ajax_action": "ttbp_delete_chapter", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to delete others\' chapters via ttbp_delete_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-03": {"ajax_action": "ttbp_update_chapter_order", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reorder others\' chapters via ttbp_update_chapter_order", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-04": {"ajax_action": "ttbp_assign_chapter_to_book", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reassign others\' chapters via ttbp_assign_chapter_to_book", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12129-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query-new(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query-new REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/importwp/v1/importer/\\\\d+/file(?:/|\\\\?|$)~"}, {"name": "ARGS:local_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|/etc/shadow|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}], "cve": "CVE-2025-12137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12137", "description": "Import WP <=2.14.16 authenticated (admin+) arbitrary file read via local_url parameter in REST API file_local import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "jc-importer", "tags": ["arbitrary-file-read", "path-traversal", "rest-api"], "target": "plugin", "versions": "<=2.14.16"}, "RULE-CVE-2025-12138-01": {"ajax_action": "uimptr_import_single_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php\\\\d?|phps|phtml|pht|phar)(?:[/?#%&\\"\'<>\\\\s]|%[0-9a-fA-F]{2}|$)~i"}], "cve": "CVE-2025-12138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12138", "description": "URL Image Importer <=1.0.6 authenticated (Author+) arbitrary file upload via uimptr_import_single_url AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "url-image-importer", "tags": ["arbitrary-file-upload", "content-type-spoofing", "authenticated"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-12151-01": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "add_simple_folio"}, {"name": "ARGS:portfolio_name", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via portfolio_name parameter in add_simple_folio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12151-02": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "remove_portfolio"}, {"name": "ARGS:id", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via id parameter in remove_portfolio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12159-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-03": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-04": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_fe_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12160-01A": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01B": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[all]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[all] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01C": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[subscriber]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[subscriber] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01D": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[editor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[editor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01E": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[author]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[author] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01F": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[contributor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[contributor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01G": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[administrator]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[administrator] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img[^>]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~<img[^>]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (REST API)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12170-01": {"ajax_action": "checkbox_clean_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12170", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12170", "description": "Checkbox <=2.8.10 missing authorization on checkbox_clean_log AJAX endpoint allows unauthenticated log clearing", "mode": "block", "severity": 5.3, "slug": "checkbox", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.8.10"}, "RULE-CVE-2025-12181-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cstu_update_post"}, {"name": "ARGS:image_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?#]|%00|$)~i"}], "cve": "CVE-2025-12181", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12181", "description": "ContentStudio <=1.3.7 authenticated arbitrary file upload via cstu_update_post image_url parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contentstudio", "tags": ["arbitrary-file-upload", "unrestricted-upload", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-12181-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cstu_create_new_post"}, {"name": "ARGS:featured_image", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?#]|%00|$)~i"}], "cve": "CVE-2025-12181", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12181", "description": "ContentStudio <=1.3.7 authenticated arbitrary file upload via cstu_create_new_post featured_image parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contentstudio", "tags": ["arbitrary-file-upload", "unrestricted-upload", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-12192-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe_events/v2/[^/]{0,5}/sysinfo~"}], "cve": "CVE-2025-12192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12192", "description": "The Events Calendar <=6.15.9 unauthenticated information disclosure via sysinfo REST endpoint loose key comparison", "method": "GET", "mode": "block", "severity": 5.3, "slug": "the-events-calendar", "tags": ["information-disclosure", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-12197-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/tec/v[0-9]+/events(?:\\\\?|$)|\\\\?rest_route=/tec/v[0-9]+/events(?:&|$))~i"}, {"name": "ARGS:/^(?:search|s)$/", "type": "regex", "value": "~(?i)(?:(?:sleep|pg_sleep|benchmark)\\\\s*\\\\(|waitfor\\\\s+(?:delay|nowait)\\\\b)~"}], "cve": "CVE-2025-12197", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12197", "description": "The Events Calendar 6.15.1.1-6.15.9 unauthenticated blind SQL injection via the search parameter on the /wp-json/tec/v*/events REST endpoint. CVE-2025-12197 is an incomplete-fix continuation of CVE-2025-9807; the Custom_Tables_Query.php sink remained exploitable through 6.15.9. Fixed completely in 6.15.10.", "method": "GET", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sqli", "blind-sqli", "rest-api", "unauthenticated", "incomplete-fix"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-1232-01": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:title", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review title on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-1232-02": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review content on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-12324-01": {"ajax_action": "tablepress_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\)\\\\s*;|</script|<script|\\\\\\\\x3c\\\\s*script)~i"}], "cve": "CVE-2025-12324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12324", "description": "TablePress <=3.2.4 Authenticated (Contributor+) Stored XSS via DataTables datetime format JS injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "javascript-injection"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-12348-01": {"ajax_action": "ig_es_run_action_scheduler_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12348", "description": "Icegram Express (Email Subscribers) <=5.9.10 unauthenticated scheduled task execution via ig_es_run_action_scheduler_task AJAX (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "email-subscribers", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=5.9.10"}, "RULE-CVE-2025-12348-02": {"ajax_action": "ig_es_run_action_scheduler_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12348", "description": "Icegram Express (Email Subscribers) <=5.9.10 unauthenticated scheduled task execution via ig_es_run_action_scheduler_task AJAX (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "email-subscribers", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=5.9.10"}, "RULE-CVE-2025-12353-01": {"ajax_action": "wpfnl_optin_submission", "conditions": [{"name": "ARGS:optin_allow_registration", "type": "equals", "value": "yes"}], "cve": "CVE-2025-12353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12353", "description": "WPFunnels <=3.6.2 unauthorized user registration via optin_allow_registration parameter on wpfnl_optin_submission AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpfunnels", "tags": ["authorization-bypass", "user-registration", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12353-02": {"ajax_action": "wpfnl_gutenberg_optin_submission", "conditions": [{"name": "ARGS:optin_allow_registration", "type": "equals", "value": "yes"}], "cve": "CVE-2025-12353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12353", "description": "WPFunnels <=3.6.2 unauthorized user registration via optin_allow_registration parameter on wpfnl_gutenberg_optin_submission AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpfunnels", "tags": ["authorization-bypass", "user-registration", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12353-03": {"ajax_action": "wpfnl_shortcode_optin_submission", "conditions": [{"name": "ARGS:optin_allow_registration", "type": "equals", "value": "yes"}], "cve": "CVE-2025-12353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12353", "description": "WPFunnels <=3.6.2 unauthorized user registration via optin_allow_registration parameter on wpfnl_shortcode_optin_submission AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpfunnels", "tags": ["authorization-bypass", "user-registration", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12359-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/block-renderer/|\\\\?(?:.*&)?rest_route=/wp/v2/block-renderer/)~"}, {"name": "ARGS:attributes[imageURL]", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12359-02": {"ajax_action": "rl-get-preview-content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12359-03": {"ajax_action": "rl-get-gallery-page-content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12359-04": {"ajax_action": "rl-post-gallery-preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sermon-views\\\\b[^\\\\]]*(?:<script|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-12368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12368", "description": "Sermon Manager <=2.30.0 Stored XSS via sermon-views shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sermon-manager-for-wordpress", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.30.0"}, "RULE-CVE-2025-12371-01": {"ajax_action": "nari100", "conditions": [{"name": "ARGS:do", "type": "equals", "value": "save"}, {"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,} *=~i"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Stored XSS via account save action", "method": "POST", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12371-02": {"ajax_action": "nari100", "conditions": [{"name": "ARGS:by", "type": "detectXSS"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Reflected XSS via by parameter", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12375-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/printful/v2/advanced-size-chart(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~://(?:localhost|127\\\\.|10\\\\.|0\\\\.|169\\\\.254|172\\\\.(?:1[6-9]|2\\\\d|3[01])|192\\\\.168|\\\\[::1\\\\]|\\\\[0:|0\\\\.0\\\\.0\\\\.0)~i"}], "cve": "CVE-2025-12375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12375", "description": "Printful Integration for WooCommerce <=2.2.11 authenticated SSRF via advanced size chart REST API endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "printful-shipping-for-woocommerce", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.2.11"}, "RULE-CVE-2025-12376-01": {"ajax_action": "fs_api_request", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "fs_api_request"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:https?:)?//~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12376", "description": "Icon List Block <=1.2.1 authenticated (Subscriber+) SSRF via fs_api_request AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "icon-list-block", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12379-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12384-01": {"ajax_action": "bplde_save_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document creation/update via bplde_save_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-02": {"ajax_action": "bplde_get_all", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document listing via bplde_get_all AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-03": {"ajax_action": "bplde_get_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document read via bplde_get_single AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-04": {"ajax_action": "bplde_delete_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document deletion via bplde_delete_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12388-01": {"ajax_action": "bicbPipeChecker", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|localhost|0x7f000001|2130706433|\\\\[::1\\\\]|\\\\[::ffff:|169\\\\.254\\\\.)|\\\\.internal[/:\\\\s]|^(?!https?://).+://)~i"}], "cve": "CVE-2025-12388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12388", "description": "B Carousel Block <=1.1.5 authenticated (Subscriber+) SSRF via bicbPipeChecker AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "b-carousel-block", "tags": ["ssrf", "missing-authorization", "server-side-request-forgery"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12392-01": {"action": "admin_post_nopriv_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows unauthenticated tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12392-02": {"action": "admin_post_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows low-privilege tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12402-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "ARGS:update_linkedinresumeSettings", "type": "exists"}, {"name": "ARGS:linkedinId", "type": "detectXSS"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 CSRF to Stored XSS via unsanitized linkedinId parameter in admin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12402-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "REQUEST_URI", "type": "regex", "value": "~<script[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|%3Cscript|%3E%3Cscript~i"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 Reflected XSS via unsanitized REQUEST_URI in admin page form action", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12406-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:access_key", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via access_key parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot1", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot1 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot2", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot2 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:output_to_all", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via output_to_all parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "REQUEST_URI", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=|%3c[a-z/!]|%6a%61%76%61%73%63%72%69%70%74~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 Reflected XSS via REQUEST_URI in settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12408-01": {"action": "init", "conditions": [{"name": "ARGS:em_ajax_action", "type": "equals", "value": "get_location"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12408", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12408", "description": "Events Manager <=7.2.2.2 unauthenticated information exposure via get_location custom AJAX dispatcher", "mode": "block", "severity": 5.3, "slug": "events-manager", "tags": ["information-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.2.2.2"}, "RULE-CVE-2025-12448-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smartsupp"}, {"name": "ARGS:ssaction", "type": "equals", "value": "update"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12448", "description": "Smartsupp \\u2013 live chat, AI shopping assistant and chatbots <=3.9.1 authenticated (Subscriber+) unauthorized settings update via code parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smartsupp-live-chat", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-12449-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_settings AJAX action exposes sensitive API keys to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_settings AJAX action allows Subscriber+ to modify plugin settings and API keys", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_block_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_block_visibility AJAX action allows Subscriber+ to toggle block visibility", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-04": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_blocks_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_blocks_visibility AJAX action exposes block configuration to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/fetch_posts"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on fetch_posts AJAX action allows Subscriber+ to enumerate posts", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12450-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^litespeed~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|on(?:error|load|focus|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2025-12450", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12450", "description": "LiteSpeed Cache <=7.5.0.1 Reflected XSS via unsanitized REQUEST_URI in admin page form_action output", "method": "GET", "mode": "block", "severity": 6.1, "slug": "litespeed-cache", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.5.0.1"}, "RULE-CVE-2025-12451-01": {"ajax_action": "svg_get_attachment_url", "conditions": [{"name": "ARGS:attachmentID", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12451", "description": "Easy SVG Support <=4.0 authenticated stored XSS via missing authorization on svg_get_attachment_url AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "easy-svg", "tags": ["xss", "missing-authorization", "stored-xss", "svg-upload"], "target": "plugin", "versions": "<=4.0"}, "RULE-CVE-2025-12456-01": {"ajax_action": "cai_ajaxaction", "conditions": [{"name": "ARGS:cai_name_color", "type": "detectXSS"}], "cve": "CVE-2025-12456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12456", "description": "Centangle Team Showcase <=1.0.0 CSRF to Stored XSS via cai_name_color in cai_ajaxaction AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "centangle-team", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12471-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "dpsp-dashboard"}, {"name": "ARGS:dpsp_list_attention_search", "type": "detectXSS"}], "cve": "CVE-2025-12471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12471", "description": "Hubbub Lite (Social Pug) <=1.36.0 reflected XSS via dpsp_list_attention_search parameter on admin dashboard", "mode": "block", "severity": 6.1, "slug": "social-pug", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.36.0"}, "RULE-CVE-2025-12473-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:[/?]|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "themebuilder"}, {"name": "ARGS:themebuilder", "type": "regex", "value": "~(?:%25(?:3[cC]|3[eE]|22|27)|%3[cC]|%3[eE]|%22|%27|<|>|\\"|\'|on(?:error|load)\\\\s*=|<\\\\s*(?:script|img|svg)\\\\b)~i"}], "cve": "CVE-2025-12473", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12473", "description": "RomethemeKit For Elementor <=1.6.8 Reflected XSS via themebuilder parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rometheme-for-elementor", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-12475-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12482-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:%\'[\\\\s]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|HAVING|WHERE|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)[\\\\s(]|/\\\\*[\\\\s\\\\S]*?\\\\*/)~i"}], "cve": "CVE-2025-12482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12482", "description": "Amelia Booking <=1.2.35 unauthenticated SQL injection via search parameter in wpamelia_api AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ameliabooking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.2.35"}, "RULE-CVE-2025-12484-01": {"ajax_action": "rafflepress_lite_giveaway_api", "conditions": [{"name": "ARGS:entry_option", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:>|\\\\bon\\\\w+\\\\s*=)|javascript\\\\s*:|&#(?:60|x3[cC]);~i"}], "cve": "CVE-2025-12484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12484", "description": "RafflePress <=1.12.19 unauthenticated stored XSS via entry_option JSON blob in giveaway API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rafflepress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.12.19"}, "RULE-CVE-2025-12493-01": {"ajax_action": "woolentor_load_more_products", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|\\\\.\\\\.%2f|\\\\.\\\\.%5c)~i"}], "cve": "CVE-2025-12493", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2025-12499-01": {"ajax_action": "grw_overview_ajax", "conditions": [{"name": "ARGS:place_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via place_id in grw_overview_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-02": {"ajax_action": "grw_feed_save_ajax", "conditions": [{"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via post_id in grw_feed_save_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-03": {"ajax_action": "grw_connect_google", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized POST data in grw_connect_google", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-04": {"ajax_action": "grw_place_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 reflected XSS via unsanitized POST data in grw_place_autocomplete", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-05": {"ajax_action": "grw_get_place", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized Google Place data in grw_get_place", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12505-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wedocs/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12505", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12505", "description": "weDocs <=2.1.14 missing authorization on REST settings update allows Subscriber+ to modify global plugin settings", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wedocs", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12537-01": {"ajax_action": "eae_save_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_save_config AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12537-02": {"ajax_action": "eae_elements_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_elements_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12538-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "regex", "value": "~^iworks_fleet_(?:person|boat|result)$~"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|resize|pointerdown)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/]|<embed[\\\\s/>]|<object[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12538", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12538", "description": "Fleet Manager <=2.5.1 Stored XSS via unsanitized post meta in person/boat/result custom post type admin columns", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fleet", "tags": ["xss", "stored-xss", "custom-post-type"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-12539-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]tnc-toolbox-config[/\\\\\\\\]~i"}], "cve": "CVE-2025-12539", "method": "GET", "mode": "block", "severity": 10.0, "slug": "tnc-toolbox", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-12540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/plugins/googleanalytics/credentials\\\\.json(?:\\\\?|$)~i"}], "cve": "CVE-2025-12540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12540", "description": "ShareThis Dashboard for Google Analytics <=3.2.4 unauthenticated sensitive credential exposure via credentials.json static file access", "mode": "block", "severity": 4.7, "slug": "googleanalytics", "tags": ["sensitive-data-exposure", "unauthenticated", "static-file-disclosure"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-12560-01": {"ajax_action": "b2s_get_full_content", "conditions": [{"name": "ARGS:post_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12560", "description": "Blog2Social <=8.6.0 authenticated (Subscriber+) blind SSRF via post_url in b2s_get_full_content AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "blog2social", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.6.0"}, "RULE-CVE-2025-12569-01": {"action": "init", "conditions": [{"name": "ARGS:redirect", "type": "regex", "value": "~^(?:https?:|//)~i"}], "cve": "CVE-2025-12569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12569", "description": "WP Front User Submit / Front Editor <=4.9.5 open redirect via unvalidated redirect parameter in registration/login shortcode form submission", "method": "POST", "mode": "block", "severity": 4.7, "slug": "front-editor", "tags": ["open-redirect", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=4.9.5"}, "RULE-CVE-2025-12583-01": {"ajax_action": "neofix_sdl_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_add AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-02": {"ajax_action": "neofix_sdl_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_edit AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-03": {"ajax_action": "neofix_sdl_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_delete AJAX action allowing Subscriber+ unauthorized deletion", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-04": {"ajax_action": "neofix_sdl_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_restore AJAX action allowing Subscriber+ unauthorized restore", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-05": {"ajax_action": "neofix_sdl_get_file_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_get_file_url AJAX action allowing Subscriber+ information disclosure", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12621-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_ID", "type": "exists"}, {"name": "ARGS:status", "type": "regex", "value": "~(?i)^\\\\s*(approved|refused)\\\\s*$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12621", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12621", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.42 incorrect authorization on fr_refund_request AJAX action allows Contributor+ to approve/refuse refunds", "method": "POST", "mode": "block", "severity": 5.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["incorrect-authorization", "broken-access-control", "woocommerce"], "target": "plugin", "versions": "<=1.0.42"}, "RULE-CVE-2025-12628-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "validate_2fa"}, {"name": "ARGS:provider", "type": "regex", "value": "~^(?i)backup(?:_|%5[fF])codes$~"}, {"name": "ARGS:wp-2fa-backup-code", "type": "exists"}], "cve": "CVE-2025-12628", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12628", "description": "WP 2FA <=2.9.3 second factor bypass via brute-force of low-entropy backup codes on validate_2fa endpoint", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-2fa", "tags": ["authentication-bypass", "insufficient-entropy", "brute-force"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-12630-01": {"ajax_action": "upload_am_get_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option disclosure via upload_am_get_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12630-02": {"ajax_action": "upload_am_update_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option update via upload_am_update_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12633-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v1/commerce/stripe/return(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12633", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12633", "description": "Bookit <=2.5.0 missing authorization on Stripe Connect return REST endpoint allows unauthenticated Stripe account linkage", "method": "GET", "mode": "block", "severity": 7.5, "slug": "bookit", "tags": ["missing-authorization", "unauthenticated", "rest-api", "stripe-connect"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/link-status-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on link-status-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-1264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/links-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on links-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-12641-01": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12641-02": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12643-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12643-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post_content param", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12646-01": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12646-02": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler (GET variant)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12650-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12650-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12654-01": {"ajax_action": "wpvividstg_check_filesystem_permissions_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:create_new_wp", "type": "equals", "value": "1"}, {"name": "ARGS:pwd", "type": "regex", "value": "~(^/|^[A-Za-z]:\\\\\\\\|\\\\.{2}|[/\\\\\\\\]{2,}|/etc/|^/var/|^/tmp/|/\\\\.|\\\\\\\\\\\\.)~i"}], "cve": "CVE-2025-12654", "method": "POST", "mode": "block", "severity": 2.7, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.120"}, "RULE-CVE-2025-12658-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12661-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post[.]php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12661-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|[?])rest_route=)/wp/v2/posts(/|[?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12673-01": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-02": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-03": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-04": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12676-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kiotviet-sync/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12676", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12676", "description": "KiotViet Sync <=1.8.5 unauthenticated authorization bypass via hardcoded password on REST API endpoints", "method": "POST", "mode": "block", "severity": 5.3, "slug": "kiotvietsync", "tags": ["hardcoded-credentials", "authorization-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-12677-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kiot(?:viet(?:sync)?)/(?:v[0-9]+/)?webhook(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12677", "description": "KiotViet Sync <=1.8.5 unauthenticated sensitive information exposure via webhook REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "kiotvietsync", "tags": ["information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-12681-01": {"ajax_action": "sce_get_comment", "conditions": [{"name": "ARGS:comment_id", "type": "exists"}], "cve": "CVE-2025-12681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12681", "description": "Simple Comment Editing <=3.1.0 unauthenticated sensitive information exposure via sce_get_comment AJAX action", "mode": "block", "severity": 5.3, "slug": "simple-comment-editing", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-12682-01": {"action": "init", "conditions": [{"name": "FILES:file_during_checkout", "type": "exists"}], "cve": "CVE-2025-12682", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easy-upload-files-during-checkout", "target": "plugin", "versions": "<=2.9.8"}, "RULE-CVE-2025-12691-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<img\\\\b[^>]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12691-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<img\\\\b[^>]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12707-01": {"ajax_action": "owt_lib_handler", "conditions": [{"name": "ARGS:bid", "type": "regex", "value": "~(?:VU5JT04=|U0VMRUNU|SU5TRVJU|VVBEQVRF|REVMRVRF|RFJPUA==|QU5E|T1I=|U0xFRVA=|RVhUUkFDVFZBTFVF|Q09OQ0FU|T1JERVIgQlk=|R1JPVVAgQlk=)~i"}], "cve": "CVE-2025-12707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12707", "description": "Library Management System <=3.2.1 unauthenticated SQL injection via bid parameter in owt_lib_handler AJAX handler", "mode": "block", "severity": 7.5, "slug": "library-management-system", "tags": ["sql-injection", "unauthenticated", "base64-encoded-parameter"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-12709-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/interact/v1/update_interaction(?:/|\\\\?|&|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[^>]*>|</?(?:svg|iframe|embed|object|math|details)[\\\\s/>]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12709", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12709", "description": "Interactions <= 1.3.1 Authenticated (Contributor+) Stored XSS via event selectors in update_interaction REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "interactions", "tags": ["xss", "stored-xss", "rest-api", "missing-capability"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-12718-01": {"ajax_action": "qcf_validate_form", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2025-12718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12718", "description": "Quick Contact Form <=8.2.6 unauthenticated open mail relay via email header injection in qcf_validate_form AJAX handler", "method": "POST", "mode": "block", "severity": 5.8, "slug": "quick-contact-form", "tags": ["email-header-injection", "open-mail-relay", "unauthenticated", "improper-input-validation"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2025-12721-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fflcockpit/v1/server_status(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12721", "description": "g-FFL Cockpit <=1.7.1 unauthenticated information disclosure via /fflcockpit/v1/server_status REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "g-ffl-cockpit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-12746-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "detectXSS"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via search parameter in front-end template", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12746-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(\\\\\\"|\')\\\\s*on\\\\w+\\\\s*=|<(script|svg|iframe|img)[\\\\s/>]|javascript\\\\s*:~i"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via arbitrary GET parameters reflected into hidden form fields", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12747-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?i)^/wp-content/uploads/tainacan-items/\\\\d+/_x_\\\\d+/~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12747", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12747", "description": "Tainacan <=1.0.0 unauthenticated information exposure via direct access to private files in tainacan-items uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "tainacan", "tags": ["information-exposure", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12754-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[geopost\\\\b[^\\\\]]*(?:height|width)\\\\s*=\\\\s*[^\\\\]]*(?:<script|<svg|<iframe|<img|<details|<body|<marquee|on(?:error|load|click|mouseover|focus|blur|mouse(?:enter|leave|move|out|up|down))\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12754", "description": "Geopost <=1.1 Stored XSS via height/width shortcode attribute injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "geopost", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-12778-01": {"ajax_action": "wp_filter_users", "conditions": [{"type": "missing_capability", "value": "list_users"}], "cve": "CVE-2025-12778", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12778", "description": "Ultimate Member Widgets for Elementor <=2.3 unauthenticated information exposure via wp_filter_users AJAX handler", "mode": "block", "severity": 5.3, "slug": "ultimate-member-widgets-for-elementor", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-12778-02": {"ajax_action": "um_filter_users", "conditions": [{"type": "missing_capability", "value": "list_users"}], "cve": "CVE-2025-12778", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12778", "description": "Ultimate Member Widgets for Elementor <=2.3 unauthenticated information exposure via um_filter_users AJAX handler", "mode": "block", "severity": 5.3, "slug": "ultimate-member-widgets-for-elementor", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-12787-01": {"ajax_action": "tfhb_meeting_form_cencel", "conditions": [{"name": "ARGS:hash", "type": "regex", "value": "~^.{0,7}$|[<>\'\\";&|`]~"}], "cve": "CVE-2025-12787", "method": "POST", "mode": "block", "severity": 5.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12800-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "su_generator_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_csv_table[^\\\\]]*url\\\\s*=~i"}], "cve": "CVE-2025-12800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12800", "description": "Shortcodes Ultimate <=7.4.5 Server-Side Request Forgery via su_csv_table shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["ssrf", "server-side-request-forgery", "shortcode"], "target": "plugin", "versions": "<=7.4.5"}, "RULE-CVE-2025-12803-01": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Stored XSS via bt_bb_tabs shortcode event handler injection in bt_bb_fe_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12803-02": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*<script~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Stored XSS via bt_bb_tabs shortcode script injection in bt_bb_fe_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12803-03": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Reflected XSS via bt_bb_tabs shortcode event handler injection in bt_bb_get_html AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12803-04": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*<script~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Reflected XSS via bt_bb_tabs shortcode script injection in bt_bb_get_html AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12803-05": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Reflected XSS via bt_bb_tabs shortcode event handler injection in bt_bb_fe_get_html AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12803-06": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_tabs\\\\b[^\\\\]]*<script~i"}], "cve": "CVE-2025-12803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12803", "description": "Bold Page Builder <=5.5.1 Reflected XSS via bt_bb_tabs shortcode script injection in bt_bb_fe_get_html AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "shortcode"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2025-12804-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (classic editor injection phase)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12814-01": {"ajax_action": "siteseo_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings reset via siteseo_reset_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-02": {"ajax_action": "siteseo_export_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings export via siteseo_export_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-03": {"ajax_action": "siteseo_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings import via siteseo_import_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "settings-injection"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-04": {"ajax_action": "siteseo_migrate_seo", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized SEO data migration via siteseo_migrate_seo AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12824-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[player_leaderboard\\\\b[^\\\\]]*mode\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data)://)~i"}], "cve": "CVE-2025-12824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12824", "description": "Player Leaderboard <=1.0.2 authenticated (Contributor+) Local File Inclusion via player_leaderboard shortcode mode attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "player-leaderboard", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12824-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[player_leaderboard\\\\b[^\\\\]]*mode\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data)://)~i"}], "cve": "CVE-2025-12824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12824", "description": "Player Leaderboard <=1.0.2 authenticated (Contributor+) Local File Inclusion via REST API post content containing malicious player_leaderboard shortcode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "player-leaderboard", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12826-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cptui_process_post_type"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12826", "description": "Custom Post Type UI <=1.18.0 missing authorization on custom post type modification via cptui_process_post_type", "method": "POST", "mode": "block", "severity": 4.8, "slug": "custom-post-type-ui", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2025-12826-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cptui_process_taxonomy"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12826", "description": "Custom Post Type UI <=1.18.0 missing authorization on custom taxonomy modification via cptui_process_taxonomy", "method": "POST", "mode": "block", "severity": 4.8, "slug": "custom-post-type-ui", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2025-12830-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "contains", "value": "better-slider"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~better-slider[\\\\s\\\\S]{0,500}(?:<script[\\\\s>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|embed|object|details|math)[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12830", "description": "Better Elementor Addons <=1.5.5 Stored XSS via Slider widget title_html_tag and title fields in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "better-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.5"}, "RULE-CVE-2025-12836-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s(?:on\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description event-handler injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12836-02": {"action": "init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<(?:script[\\\\s>]|/script>|iframe[\\\\s>]|svg[\\\\s/>]|embed[\\\\s>]|object[\\\\s>]|scrscriptipt\\\\b)|\\\\b(?:href|src|xlink:href)\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description dangerous element injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12837-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:waf_probe", "type": "regex", "value": "~<script[\\\\s/>]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in REST API content save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12837-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[\\\\s/>]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/bookit/v1/commerce/stripe/return(?:/|\\\\?|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12841-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookit/v1/commerce/stripe/return(?:/|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint (rest_route fallback)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12844-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTranscribeAudio(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTranscribeAudio REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleVisionQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleVisionQuery REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleFastTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleFastTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleJsonQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleJsonQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12845-01": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12845", "description": "Tablesome <=1.2.1 missing authorization on get_tables_data AJAX action allows subscriber+ to retrieve sensitive table data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12851-01": {"action": "init", "conditions": [{"name": "ARGS:controller", "type": "regex", "value": "~(?:[\\\\.\\\\\\\\/-]|%2[dDeEfF]|%5[cC])~"}], "cve": "CVE-2025-12851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12851", "description": "My auctions allegro <=3.6.32 unauthenticated Local File Inclusion via controller parameter on init hook", "mode": "block", "severity": 8.1, "slug": "my-auctions-allegro-free-edition", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=3.6.32"}, "RULE-CVE-2025-1287-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:text_days|text_hours|text_minutes|text_seconds|cpybtntext|lanugaetext|copiedbtntext|cpyerrbtntext|dwnldBtnText|nav_dots_tooltips|fp-slideid)[^}]{0,200}(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1287", "description": "The Plus Addons for Elementor <=6.2.2 Stored XSS via Countdown/Syntax Highlighter/Page Scroll widget settings in post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2025-1287-02": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:text_days|text_hours|text_minutes|text_seconds|cpybtntext|lanugaetext|copiedbtntext|cpyerrbtntext|dwnldBtnText|nav_dots_tooltips|fp-slideid)[^}]{0,200}(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1287", "description": "The Plus Addons for Elementor <=6.2.2 Stored XSS via Countdown/Syntax Highlighter/Page Scroll widget settings in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2025-12876-01": {"ajax_action": "pto_delete_file", "conditions": [{"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-12876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12876", "description": "Projectopia - WordPress Project Management <=5.1.19 missing authorization on pto_delete_file AJAX action allowing unauthenticated arbitrary attachment deletion", "method": "POST", "mode": "block", "severity": 5.3, "slug": "projectopia-core", "tags": ["missing-authorization", "unauthenticated", "arbitrary-deletion"], "target": "plugin", "versions": "<=5.1.19"}, "RULE-CVE-2025-12885-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[embeddoc\\\\b[^\\\\]]*url\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script|data\\\\s*:[^\\"\']*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12885", "description": "Embed Any Document <=2.7.10 Contributor+ Stored XSS via embeddoc shortcode url attribute (REST API content)", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "target": "plugin", "versions": "<=2.7.10"}, "RULE-CVE-2025-12885-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embeddoc\\\\b[^\\\\]]*url\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script|data\\\\s*:[^\\"\']*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12885", "description": "Embed Any Document <=2.7.10 Contributor+ Stored XSS via embeddoc shortcode url attribute (classic editor post_content)", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "target": "plugin", "versions": "<=2.7.10"}, "RULE-CVE-2025-12891-01": {"ajax_action": "ays_survey_show_results", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12891", "mode": "block", "severity": 5.3, "slug": "survey-maker", "target": "plugin", "versions": "<=5.1.9.4"}, "RULE-CVE-2025-12894-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/exportwp(?:/|%2f).*(?:\\\\.(csv|xml|json|log|txt|gz|zip))([?#]|$)~i"}], "cve": "CVE-2025-12894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12894", "description": "Import WP <=2.14.17 unauthenticated access to exported data files via /exportwp/ directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "jc-importer", "tags": ["information-disclosure", "unauthenticated", "sensitive-file-access"], "target": "plugin", "versions": "<=2.14.17"}, "RULE-CVE-2025-12894-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/importwp(?:/|%2f).*(?:\\\\.(csv|xml|json|log|txt|gz|zip))([?#]|$)~i"}], "cve": "CVE-2025-12894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12894", "description": "Import WP <=2.14.17 unauthenticated access to import session data and debug logs via /importwp/ directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "jc-importer", "tags": ["information-disclosure", "unauthenticated", "sensitive-file-access"], "target": "plugin", "versions": "<=2.14.17"}, "RULE-CVE-2025-12904-01": {"ajax_action": "insert_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|object|embed|math|details|body|marquee)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12904", "description": "H5PxAPIkatchu <= 0.4.17 Unauthenticated Stored XSS via insert_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "h5pxapikatchu", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.17"}, "RULE-CVE-2025-1291-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-12934-01": {"ajax_action": "fl_builder_duplicate_wpml_layout", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}, {"name": "ARGS:original_post_id", "type": "exists"}], "cve": "CVE-2025-12934", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12934", "description": "Beaver Builder <= 2.9.4.1 missing authorization on duplicate_wpml_layout AJAX handler allows Subscriber+ arbitrary post update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-update"], "target": "plugin", "versions": "<=2.9.4.1"}, "RULE-CVE-2025-12935-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12935-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12955-01": {"ajax_action": "pisol_live_orders", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12955", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12955", "description": "Live Sales Notification for WooCommerce <=2.3.39 missing authorization on pisol_live_orders AJAX handler exposing customer order data", "mode": "block", "severity": 7.5, "slug": "live-sales-notifications-for-woocommerce", "tags": ["missing-authorization", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.3.39"}, "RULE-CVE-2025-12960-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12960-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12963-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazytasks/api/v1/user/role/edit(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12963", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lazytasks-project-task-management", "target": "plugin", "versions": "<=1.2.29"}, "RULE-CVE-2025-12964-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_title_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_subtitle_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_subtitle_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdal_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdal_title_tag in Products Awesome List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpcar_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpcar_title_tag in Products Carousel Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-05": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdeg_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdeg_title_tag in Products Grid/Tab Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-06": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdel_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdel_title_tag in Products List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12973-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "s2b_store_chatbot_upload"}, {"name": "FILES:s2baia_chatbot_config_database", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12973", "description": "S2B AI Assistant <=1.7.8 arbitrary file upload via s2b_store_chatbot_upload admin-post action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "s2b-ai-assistant", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.7.8"}, "RULE-CVE-2025-12984-01": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-12984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12984", "description": "Advanced Ads <=2.0.15 authenticated (admin+) SQL injection via order parameter in placement list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "advanced-ads", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.0.15"}, "RULE-CVE-2025-13006-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/fsd(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/fsd REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses/[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses/{id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys/survey_id=[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys/survey_id={id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13031-01": {"action": "admin_post_save_wpematico_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Stored XSS via unsanitized settings output in settings_form()", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-02": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:return_url", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:(?:text/html|application/xhtml)|on\\\\w+\\\\s*=|<script)~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via return_url in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-03": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:item_hash", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via item_hash in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-04": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:feed", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via feed parameter in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-05": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:campaign", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via campaign parameter in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-06": {"action": "admin_post_wpematico_campaign_preview", "conditions": [{"name": "ARGS:p", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via p parameter in campaign preview", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13035-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "POST", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13035-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "POST", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13035-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "PUT", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13035-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "PATCH", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13048-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/(?:profile|user-edit)\\\\.php)~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:<script[\\\\s>]|<[^>]+[\\\\s/]+on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13048", "description": "Official StatCounter Plugin <=2.1.0 Authenticated (Contributor+) Stored XSS via Nickname", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored-xss", "missing-output-escaping"], "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-13054-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-1307-01": {"ajax_action": "newscrunch_install_activate_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-1307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1307", "description": "Newscrunch <=1.8.4 missing authorization on newscrunch_install_activate_plugin allows subscriber+ arbitrary plugin installation and RCE", "mode": "block", "severity": 9.8, "slug": "newscrunch", "tags": ["missing-authorization", "arbitrary-file-upload", "remote-code-execution"], "target": "theme", "versions": "<=1.8.4"}, "RULE-CVE-2025-13072-01": {"action": "init", "conditions": [{"name": "ARGS:utm_source", "type": "detectXSS"}], "cve": "CVE-2025-13072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13072", "description": "HandL UTM Grabber <=2.8 Reflected XSS via utm_source query parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2025-13073-01": {"ajax_action": "handl_get_zapier_log", "conditions": [{"name": "ARGS:handl_landing_page", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13073", "description": "HandL UTM Grabber <=2.8 reflected XSS via handl_landing_page in handl_get_zapier_log AJAX handler", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<2.8.1"}, "RULE-CVE-2025-1309-01": {"ajax_action": "uip_save_form_as_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1309", "description": "UiPress Lite <=3.5.04 missing authorization on uip_save_form_as_option AJAX handler allows arbitrary options update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "uipress-lite", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=3.5.04"}, "RULE-CVE-2025-1310-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~job-postings-get-file/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (rewrite rule path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1310-02": {"action": "parse_request", "conditions": [{"name": "ARGS:job_postings_get_file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\.%2f|\\\\.\\\\.%5c|\\\\.\\\\.%252f|\\\\.\\\\.%255c|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|^/)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (query string path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1311-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcfmmp/v1/deliveries/[^/]*[^0-9/][^/]*~i"}], "cve": "CVE-2025-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1311", "description": "WCFM Marketplace REST API <=1.6.2 authenticated SQL injection via non-numeric id path segment in /wcfmmp/v1/deliveries/{id}", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wcfm-marketplace-rest-api", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2025-1312-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1312-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-13146-01": {"ajax_action": "wpcf7dtx", "conditions": [{"name": "ARGS:shortcodes[/.+/][value]", "type": "regex", "value": "~(?:[\\\\[\\\\]]|[a-zA-Z_][\\\\w-]{0,40}\\\\s*=\\\\s*[\\"\'])~"}], "cve": "CVE-2025-13146", "description": "Contact Form 7 - Dynamic Text Extension <=5.0.7 unauthenticated arbitrary shortcode execution via wpcf7dtx AJAX handler", "mode": "block", "slug": "contact-form-7-dynamic-text-extension", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2025-13153-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "logosliderwp"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on logosliderwp post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13153-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "lgx_lsp_shortcodes"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on lgx_lsp_shortcodes post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13156-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|aspx?|jspx?|cfm|user\\\\.ini)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-13156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13156", "description": "VitePos Lite <=3.3.0 authenticated arbitrary file upload via REST API leading to RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vitepos-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-13206-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor first name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13206-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor last name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13217-01": {"ajax_action": "um_update_profile_full", "conditions": [{"name": "ARGS:youtube_video", "type": "exists"}, {"name": "ARGS:youtube_video", "type": "regex", "value": "~(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13217", "description": "Ultimate Member <=2.11.0 Stored XSS via youtube_video profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.11.0"}, "RULE-CVE-2025-1324-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[public-form"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[public-form\\\\s[^\\\\]]*(?:<script|<svg|<iframe|<img|<object|<embed|javascript:|on(?:error|load|focus|click|mouseover)\\\\s*=)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1324", "description": "WP-Recall <=16.26.10 stored XSS via [public-form] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-recall", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=16.26.10"}, "RULE-CVE-2025-1325-01": {"ajax_action": "rcl_preview_post", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-1325", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1325", "description": "WP-Recall <=16.26.10 missing authorization on rcl_preview_post AJAX endpoint allows Subscriber+ arbitrary shortcode execution", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-recall", "tags": ["missing-authorization", "arbitrary-shortcode-execution", "broken-access-control"], "target": "plugin", "versions": "<=16.26.10"}, "RULE-CVE-2025-13308-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "auth_app"}, {"name": "ARGS:reject_url", "type": "regex", "value": "~(?i)(?:j[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*v[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*s[\\\\x00-\\\\x20]*c[\\\\x00-\\\\x20]*r[\\\\x00-\\\\x20]*i[\\\\x00-\\\\x20]*p[\\\\x00-\\\\x20]*t|data|vbscript)[\\\\x00-\\\\x20]*:~"}], "cve": "CVE-2025-13308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13308", "description": "Application Passwords <=0.1.3 Reflected XSS via reject_url parameter on auth_app admin page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "application-passwords", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-13308-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "auth_app"}, {"name": "ARGS:success_url", "type": "regex", "value": "~(?i)(?:j[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*v[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*s[\\\\x00-\\\\x20]*c[\\\\x00-\\\\x20]*r[\\\\x00-\\\\x20]*i[\\\\x00-\\\\x20]*p[\\\\x00-\\\\x20]*t|data|vbscript)[\\\\x00-\\\\x20]*:~"}], "cve": "CVE-2025-13308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13308", "description": "Application Passwords <=0.1.3 Reflected XSS via success_url parameter on auth_app admin page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "application-passwords", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-13308-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "auth_app"}, {"name": "ARGS:app_name", "type": "detectXSS"}], "cve": "CVE-2025-13308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13308", "description": "Application Passwords <=0.1.3 Reflected XSS via app_name parameter on auth_app admin page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "application-passwords", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-13311-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "sigijh_plugin_options"}, {"name": "ARGS:sigijh_color_select", "type": "regex", "value": "~[<>\\"\']|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13311", "description": "Just Highlight <=1.0.3 authenticated (Administrator+) stored XSS via sigijh_color_select setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "just-highlight", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13314-01": {"ajax_action": "filter_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on filter_save_settings AJAX action allows unauthenticated settings modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "settings-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13314-02": {"ajax_action": "add_filter_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on add_filter_options AJAX action allows unauthenticated post creation and meta write", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "arbitrary-post-creation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13320-01": {"action": "admin_init", "conditions": [{"name": "ARGS:account[user_avatar][path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|[/\\\\\\\\]etc[/\\\\\\\\]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-13320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13320", "description": "WP User Manager <=2.9.12 arbitrary file deletion via path traversal in avatar path parameter during profile update", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-user-manager", "tags": ["arbitrary-file-deletion", "path-traversal", "external-file-control"], "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-13329-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/add-image-data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:fileName", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2025-13329", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-uploader-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13334-01": {"ajax_action": "blaze_demo_importer_install_demo", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:reset", "type": "equals", "value": "true"}], "cve": "CVE-2025-13334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13334", "description": "Blaze Demo Importer <=1.0.13 missing authorization on blaze_demo_importer_install_demo AJAX action allows subscriber+ site reset", "method": "POST", "mode": "block", "severity": 8.1, "slug": "blaze-demo-importer", "tags": ["missing-authorization", "broken-access-control", "database-reset"], "target": "plugin", "versions": "<=1.0.13"}, "RULE-CVE-2025-13342-02": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13342", "description": "Frontend Admin (ACF Frontend Form Element) <=3.28.20 unauthenticated arbitrary options update via update_field AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.28.20"}, "RULE-CVE-2025-13358-01": {"ajax_action": "ccpcaCreatePage", "conditions": [{"type": "missing_capability", "value": "publish_pages"}], "cve": "CVE-2025-13358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13358", "description": "CodeConfig Accessibility <=1.0.0 missing authorization on ccpcaCreatePage AJAX action allows Subscriber+ arbitrary page creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "codeconfig-accessibility", "tags": ["missing-authorization", "broken-access-control", "arbitrary-content-creation"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-13359-01": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_orderby in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-02": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_order in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-03": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_maximum_terms", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 SQL injection via existing_terms_maximum_terms in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-04": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_orderby in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-05": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_order in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13364-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13367-01": {"action": "init", "conditions": [{"name": "ARGS:username", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via username GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-02": {"action": "init", "conditions": [{"name": "ARGS:info", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via info GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-03": {"action": "init", "conditions": [{"name": "ARGS:transaction_id", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via transaction_id GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13370-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) time-based SQL injection via id parameter on pl-add admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13370-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\())~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) SQL injection via id parameter on pl-add admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13376-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "projectlist-add"}, {"name": "FILES:pl_image", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13376", "description": "ProjectList <=0.3.0 authenticated arbitrary file upload via pl_image on Add Project page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "projectlist", "tags": ["arbitrary-file-upload", "file-upload", "authenticated"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13383-01": {"action": "init", "conditions": [{"name": "ARGS:jbbrd_save_search", "type": "equals", "value": "1"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|iframe|object|embed|svg|math|img|video|audio|body|details|marquee|isindex|form|input|button|select|textarea|keygen|meta|link|base|style)[\\\\s/>]|\\\\bon(?:error|load|focus|click|mouse(?:over|out|enter)|change|blur|submit|reset|key(?:up|down|press)|contextmenu|dblclick|drag|drop|input|invalid|scroll|wheel|animat(?:ion|ed)|transition)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13383", "description": "Job Board by BestWebSoft <=1.2.1 stored XSS via CSRF through unsanitized $_GET array storage in save-search", "method": "GET", "mode": "block", "severity": 6.1, "slug": "job-board", "tags": ["xss", "stored-xss", "csrf", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-13387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_first_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_first_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_last_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_last_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13403-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-in via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13403-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_no_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-out via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13409-01": {"ajax_action": "fv_get_analytics_data", "conditions": [{"name": "ARGS:params", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13409", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13409", "description": "Form Vibes <=1.4.13 authenticated SQL injection via params parameter in fv_get_analytics_data AJAX handler", "mode": "block", "severity": 4.9, "slug": "form-vibes", "tags": ["sql-injection", "authenticated", "admin-plus"], "target": "plugin", "versions": "<=1.4.13"}, "RULE-CVE-2025-13414-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export_businesses", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13414-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export (alt trigger cdash_export)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13419-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bfe/v1/revert(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-13419", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13419", "description": "Front Editor <=5.0.0 unauthenticated arbitrary media deletion via /bfe/v1/revert REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "front-editor", "tags": ["missing-authorization", "unauthenticated", "rest-api", "idor"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-13431-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_load_report AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13431-02": {"ajax_action": "slimstat_fetch_chart_data", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_fetch_chart_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13440-01": {"action": "admin_post_premmerce_delete_wishlist", "conditions": [{"name": "ARGS:wishlist", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13440", "description": "Premmerce Wishlist for WooCommerce <=1.1.10 missing authorization on deleteWishlist via admin_post action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "premmerce-woocommerce-wishlist", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2025-13448-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13448-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13463-01": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_get_html AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13463-02": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_save AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13486-01": {"ajax_action": "acfe/form/render_form_ajax", "conditions": [{"name": "ARGS:_acf_form", "type": "regex", "value": "~(?i)\\\\b(system|exec|passthru|shell_exec|popen|proc_open|file_put_contents|assert|eval)\\\\b~i"}], "cve": "CVE-2025-13486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": ">=0.9.0.5 <=0.9.1.1"}, "RULE-CVE-2025-13497-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/suremails/attachments/[^/]+\\\\.(?:php\\\\d*|phtml|phar|phps|pht|phpt|inc)(?:\\\\?|$)~i"}], "cve": "CVE-2025-13516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13516", "description": "SureMail <=1.9.0 unauthenticated RCE via direct access to uploaded PHP files in suremails attachments directory", "mode": "block", "severity": 8.1, "slug": "suremails", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "dangerous-file-type"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-13525-01": {"action": "init", "conditions": [{"name": "ARGS:order_by", "type": "detectXSS"}], "cve": "CVE-2025-13525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13525", "description": "WP Directory Kit <=1.4.5 Reflected Cross-Site Scripting via order_by parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpdirectorykit", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2025-13534-01": {"ajax_action": "eh_crm_edit_agent", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:user_id", "type": "regex", "value": "~.+~"}, {"name": "ARGS:rights", "type": "regex", "value": "~.+~"}], "cve": "CVE-2025-13534", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2025-13537-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-02": {"ajax_action": "dslc-ajax-save-draft-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-draft-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-03": {"ajax_action": "dslc-ajax-import-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-template AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-04": {"ajax_action": "dslc-ajax-import-modules-section", "conditions": [{"name": "ARGS:dslc_modules_section_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-modules-section AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~change-ad__content~"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13592-02": {"ajax_action": "advads-ad-injection-content", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~change-ad__content\\\\s*=~i"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in AJAX injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode", "ajax"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13604-03": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:\\\\s*(?:text/html|application/xhtml))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via javascript:/data: URI scheme in GET query parameter values", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:<|%3[Cc])(?:script|img|svg|iframe|object|embed|body|input|details|math|video|audio|style|form|base|link|meta)(?:\\\\s|/|>|%20|%09|%2[Ff]|%3[Ee])~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via HTML tags in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:%6[Ff]|o)n(?:error|load|click|mouseover|focus|toggle)(?:\\\\s*(?:=|%3[Dd]))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via event handlers in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13608-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-13608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-1361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "ip2location-country-blocker"}, {"type": "missing_capability", "value": "administrator"}], "cve": "CVE-2025-1361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1361", "description": "IP2Location Country Blocker <=2.38.8 missing authorization on admin_init allows unauthenticated settings disclosure", "mode": "block", "severity": 5.3, "slug": "ip2location-country-blocker", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.38.8"}, "RULE-CVE-2025-13610-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[RM_Forms\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|on(?:error|load|click|mouseover|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13610", "description": "RegistrationMagic <=6.0.6.7 Stored XSS via RM_Forms shortcode theme attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=6.0.6.7"}, "RULE-CVE-2025-13610-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[RM_Forms\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|on(?:error|load|click|mouseover|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13610", "description": "RegistrationMagic <=6.0.6.7 Stored XSS via RM_Forms shortcode theme attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=6.0.6.7"}, "RULE-CVE-2025-13620-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu/v1/save_cache/[^/?&]+(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13620", "description": "WP Social <=3.1.3 unauthenticated cache overwrite via wslu/v1/save_cache REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-social", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-13620-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu/v1/check_cache/[^/?&]+(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13620", "description": "WP Social <=3.1.3 unauthenticated cache probe via wslu/v1/check_cache REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-social", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-13620-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu/v1/settings/clear_counter_cache(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13620", "description": "WP Social <=3.1.3 unauthenticated cache wipe via wslu/v1/settings/clear_counter_cache REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-social", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-13622-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "jabbernotification.php"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:%2522|%253[Cc]|%253[Ee]|\\"|<|>|on\\\\w+\\\\s*=)[^?]*(?:\\\\?|$)~i"}], "cve": "CVE-2025-13622", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13622", "description": "Jabbernotification <=0.99-RC2 reflected XSS via PATH_INFO in admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "jabberbenachrichtigung", "tags": ["xss", "reflected-xss", "path-info"], "target": "plugin", "versions": "<=0.99-RC2"}, "RULE-CVE-2025-13626-01": {"ajax_action": "mylco_pagerank", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_pagerank AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-02": {"ajax_action": "mylco_alexa", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_alexa AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php/(?:[^?]*(?:[<>\\"\']|%3c|%3e|%22|%27).*)?[?&]page=mylco(?:&|$)~i"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via $_SERVER[\'PHP_SELF\'] path-info injection on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13641-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13645-01": {"ajax_action": "modula_unzip_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13645", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file/directory deletion via path traversal in ajax_unzip_file \\u2014 over-protection capability gate (payload is in zip binary, not HTTP params)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated", "over-protection"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13646-01": {"ajax_action": "modula_unzip_file", "conditions": [{"name": "ARGS:fileID", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13646", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file upload via modula_unzip_file AJAX handler", "method": "POST", "mode": "block", "severity": 6.6, "slug": "modula-best-grid-gallery", "tags": ["arbitrary-file-upload", "race-condition", "authenticated"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13678-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<script|javascript:|[\\"\']\\\\s*[>/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13678-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<script|javascript:|[\\"\']\\\\s*[>/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13679-01": {"ajax_action": "tutor_order_details", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13679", "description": "Tutor LMS <=3.9.3 missing authorization on tutor_order_details AJAX action allows subscriber+ to exfiltrate order PII", "mode": "block", "severity": 6.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2025-13681-01": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e[%2f%5c]){2,})~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated path traversal via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "missing-authorization"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13681-02": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated sensitive file read via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "sensitive-file-disclosure"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13682-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:bulk_trail_networks_changed", "type": "regex", "value": "~<[a-zA-Z]{2,}|<!|on[a-zA-Z]+=|javascript:|&#~i"}], "cve": "CVE-2025-13682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13682", "description": "Trail Manager <=1.0.0 stored XSS via unsanitized bulk_trail_networks_changed parameter in admin notice", "mode": "block", "severity": 4.4, "slug": "trail-manager", "tags": ["xss", "stored-xss", "admin-notice"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-13693-01": {"ajax_action": "save_gallery", "conditions": [{"name": "ARGS:ftg_script", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13693", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13693", "description": "Final Tiles Grid Gallery <=3.6.8 authenticated (Author+) stored XSS via ftg_script parameter in save_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=3.6.8"}, "RULE-CVE-2025-13697-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~blockart/countdown(?:(?:[^\\"}]|\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\")*)\\"timestamp\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\\\\\u0027|\'\\\\s*(?:on[a-z]+\\\\s*=|style\\\\s*=|href\\\\s*=)|<[a-z]|on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-13697", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13697", "description": "BlockArt Blocks <=2.2.13 Stored XSS via Countdown block timestamp attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2025-13697-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~blockart/countdown(?:(?:[^\\"}]|\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\")*)\\"timestamp\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\\\\\u0027|\'\\\\s*(?:on[a-z]+\\\\s*=|style\\\\s*=|href\\\\s*=)|<[a-z]|on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-13697", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13697", "description": "BlockArt Blocks <=2.2.13 Stored XSS via Countdown block timestamp attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2025-13705-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[customframe\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*\\"|\'[^\']*\')[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|<img|<svg|<iframe|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13705", "description": "Custom Frames <=1.0.1 authenticated (Contributor+) stored XSS via class shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "custom-frames", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13724-01": {"action": "admin_post_nopriv_vikrentcar", "conditions": [{"name": "ARGS:month", "type": "detectSQLi"}], "cve": "CVE-2025-13724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13724", "description": "VikRentCar <=1.4.4 unauthenticated SQL injection via month parameter on admin_post_nopriv_vikrentcar", "method": "POST", "mode": "block", "severity": 7.5, "slug": "vikrentcar", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-13724-02": {"action": "admin_post_vikrentcar", "conditions": [{"name": "ARGS:month", "type": "detectSQLi"}], "cve": "CVE-2025-13724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13724", "description": "VikRentCar <=1.4.4 authenticated SQL injection via month parameter on admin_post_vikrentcar", "method": "POST", "mode": "block", "severity": 7.5, "slug": "vikrentcar", "tags": ["sql-injection", "time-based-blind"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-13724-03": {"ajax_action": "vikrentcar", "conditions": [{"name": "ARGS:month", "type": "detectSQLi"}], "cve": "CVE-2025-13724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13724", "description": "VikRentCar <=1.4.4 authenticated SQL injection via month parameter on wp_ajax_vikrentcar", "method": "POST", "mode": "block", "severity": 7.5, "slug": "vikrentcar", "tags": ["sql-injection", "time-based-blind"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-13725-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/block-renderer/thim-blocks/icon(?:/|\\\\?|$)~"}, {"name": "ARGS:attributes[iconSVG]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-13725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13725", "description": "Gutenberg Thim Blocks <=1.0.1 authenticated arbitrary file read via iconSVG path traversal in thim-blocks/icon block renderer", "method": "GET", "mode": "block", "severity": 6.5, "slug": "thim-blocks", "tags": ["path-traversal", "arbitrary-file-read", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13728-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*redirect_to\\\\s*=~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|<script|javascript:)~i"}], "cve": "CVE-2025-13728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13728", "description": "FluentAuth <=2.0.3 Stored XSS via fluent_auth_reset_password shortcode redirect_to attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-security", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-13728-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*redirect_to\\\\s*=~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|<script|javascript:)~i"}], "cve": "CVE-2025-13728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13728", "description": "FluentAuth <=2.0.3 Stored XSS via fluent_auth_reset_password shortcode redirect_to attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-security", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-13730-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[openid_connect_generic_auth_url\\\\b[^\\\\]]*(?:<[^>]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13730-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[openid_connect_generic_auth_url\\\\b[^\\\\]]*(?:<[^>]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13732-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13732", "description": "s2Member <=251005 Stored XSS via s2Eot shortcode past_format/future_format/next_format/empty_format attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "s2member", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=251005"}, "RULE-CVE-2025-13732-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13732", "description": "s2Member <=251005 Stored XSS via s2Eot shortcode attributes in post_content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "s2member", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=251005"}, "RULE-CVE-2025-13732-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13732", "description": "s2Member <=251005 Stored XSS via s2Eot shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "s2member", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=251005"}, "RULE-CVE-2025-13738-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ez-toc\\\\s+[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|video|audio|details|embed|object|marquee|body|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|submit|blur|input|keydown|keyup|keypress|mousedown|mouseup|mouseenter|mouseleave|drag|drop|resize|scroll|wheel|pointer\\\\w+|focus(?:in|out))\\\\s*=)~i"}], "cve": "CVE-2025-13738", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13738", "description": "Easy Table of Contents <=2.0.78 Stored XSS via [ez-toc] shortcode attributes in Classic Editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-table-of-contents", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.78"}, "RULE-CVE-2025-13738-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ez-toc\\\\s+[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|video|audio|details|embed|object|marquee|body|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|submit|blur|input|keydown|keyup|keypress|mousedown|mouseup|mouseenter|mouseleave|drag|drop|resize|scroll|wheel|pointer\\\\w+|focus(?:in|out))\\\\s*=)~i"}], "cve": "CVE-2025-13738", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13738", "description": "Easy Table of Contents <=2.0.78 Stored XSS via [ez-toc] shortcode attributes in REST API post create/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-table-of-contents", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.78"}, "RULE-CVE-2025-13739-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cryptx\\\\b[^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13739", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13739", "description": "CryptX <=4.0.5 Authenticated (Contributor+) Stored XSS via cryptx shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cryptx", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-13739-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cryptx\\\\b[^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13739", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13739", "description": "CryptX <=4.0.5 Authenticated (Contributor+) Stored XSS via cryptx shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cryptx", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-13746-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:display_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Display Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Nickname on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User First Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:last_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Last Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13838-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13838-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13840-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13840-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13846-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13846-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13852-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13852-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13853-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]nn-tech[^]]*data_tech *=[^]]*(<[^>]+on[a-zA-Z]+=|<script|<img[^>]+onerror|<iframe|javascript:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13853", "description": "Nearby Now Reviews <=5.2 Stored XSS via nn-tech shortcode data_tech attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "nearby-now-reviews", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.2"}, "RULE-CVE-2025-13859-01": {"ajax_action": "save_customization_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_customization_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13859", "description": "AffiliateX <=1.3.9.3 missing authorization on save_customization_settings AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliatex", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.3.9.3"}, "RULE-CVE-2025-13861-01": {"ajax_action": "hf_form_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:script|svg|img|iframe|object|embed|details|marquee|video|audio|body|math|xmp|isindex|style|link|base|meta|form|input|button|select|textarea|keygen|source|track|frameset|frame|applet|xml)[\\\\s/>#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via form field values on hf_form_submit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13861-02": {"action": "init", "conditions": [{"name": "ARGS:_hf_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|svg|img|iframe|object|embed|details|marquee|video|audio|body|math|xmp|isindex|style|link|base|meta|form|input|button|select|textarea|keygen|source|track|frameset|frame|applet|xml)[\\\\s/>#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via non-AJAX form submission with _hf_form_id", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13864-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/breeze/v1/clear-all-cache(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13864", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13864", "description": "Breeze <=2.2.21 unauthenticated cache clearing via REST API endpoint breeze/v1/clear-all-cache", "method": "POST", "mode": "block", "severity": 5.3, "slug": "breeze", "tags": ["missing-authorization", "unauthenticated", "rest-api", "cache-deletion"], "target": "plugin", "versions": "<=2.2.21"}, "RULE-CVE-2025-13880-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated access to advanced settings via REST API (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13880-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated modification of advanced settings via REST API (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13886-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13887-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13887-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13889-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13889-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13896-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[igp-wp\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*[<>;()\\\\\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13896", "description": "Social Feed Gallery Portfolio <=1.3 Stored XSS via igp-wp shortcode id attribute (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-feed-gallery-portfolio", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-13897-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_name metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13897-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_company", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_company metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13898-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:<script|on[a-zA-Z]+\\\\s*=|javascript:|<img|<iframe|<svg|<object|<embed|<details[^>]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via [ultra_skype] shortcode btn_id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13898-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:<script|on[a-zA-Z]+\\\\s*=|javascript:|<img|<iframe|<svg|<object|<embed|<details[^>]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via REST API post creation with [ultra_skype] shortcode btn_id attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13904-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gancio-events?\\\\b[^\\\\]]*(?:on[a-z]+=|javascript\\\\s*:|<script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13904", "description": "WPGancio <=1.12 Stored XSS via gancio-event/gancio-events shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpgancio", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-13904-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gancio-events?\\\\b[^\\\\]]*(?:on[a-z]+=|javascript\\\\s*:|<script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13904", "description": "WPGancio <=1.12 Stored XSS via gancio-event/gancio-events shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpgancio", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-13906-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:linechart|barchart|piechart)\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13906-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:linechart|barchart|piechart)\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13907-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]button[^]]*(?:\\\\b(?:href|url|link)\\\\s*=\\\\s*([\\"\'])\\\\s*(?:javascript:|data:)|on(?:abort|blur|change|click|dblclick|error|focus|input|keydown|keypress|keyup|load|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|reset|resize|scroll|submit|unload)\\\\s*=|<script)~i"}], "cve": "CVE-2025-13907", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13907", "description": "CSS3 Buttons <=0.1 Stored XSS via [button] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "css3-buttons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-13908-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[the_tooltip\\\\b[^\\\\]]*(?:[\\\\s\\"\']on(?:click|error|load|mouseover|focus|blur|toggle|change|submit|key(?:down|up|press)|pointer(?:down|up)|mouseenter|mouseleave)\\\\s*=|javascript:|<script|<img|<svg|<iframe|<embed|<object|<details[^>]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13908-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[the_tooltip\\\\b[^\\\\]]*(?:[\\\\s\\"\']on(?:click|error|load|mouseover|focus|blur|toggle|change|submit|key(?:down|up|press)|pointer(?:down|up)|mouseenter|mouseleave)\\\\s*=|javascript:|<script|<img|<svg|<iframe|<embed|<object|<details[^>]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13958-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13963-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*(?:tmpl|prefix|suffix)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|<details\\\\b[^>]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode attributes (tmpl/prefix/suffix)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13963-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*\\\\][^\\\\[]*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|<details\\\\b[^>]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode enclosed content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13964-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_add_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section creation via lp-load-ajax=course_add_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-02": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section update via lp-load-ajax=course_update_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_delete_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section deletion via lp-load-ajax=course_delete_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated section reorder via lp-load-ajax=course_update_section_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-05": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "create_item_add_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item creation via lp-load-ajax=create_item_add_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-06": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "add_items_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item addition via lp-load-ajax=add_items_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-07": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "delete_item_from_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item deletion via lp-load-ajax=delete_item_from_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-08": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_section_and_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item move via lp-load-ajax=update_item_section_and_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-09": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_items_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item reorder via lp-load-ajax=update_items_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-10": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_of_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item update via lp-load-ajax=update_item_of_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13972-01": {"action": "parse_request", "conditions": [{"name": "ARGS:wht_download_big_object", "type": "exists"}, {"name": "ARGS:wht_download_big_object_origin", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|[\\\\\\\\/]proc[\\\\\\\\/]|[\\\\\\\\/]var[\\\\\\\\/]log|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-13972", "mode": "block", "severity": 4.9, "slug": "watchtowerhq", "target": "plugin", "versions": "<=3.16.0"}, "RULE-CVE-2025-13973-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/uploads/stickeasy-protected-contact-form/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/uploads/stickeasy-protected-contact-form/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.0 uploads directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13973-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/spcf-logs/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/spcf-logs/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.1 spcf-logs directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13974-01": {"ajax_action": "thwecmf_template_actions", "conditions": [{"name": "ARGS:contents", "type": "regex", "value": "~<\\\\s*(?:script|iframe|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|change|submit|input)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]+\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13974", "description": "Email Customizer for WooCommerce <=2.6.7 authenticated stored XSS via template content save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "email-customizer-for-woocommerce", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.6.7"}, "RULE-CVE-2025-13977-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13989-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13989-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13999-01": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|tftp|ldap|ssh)://~i"}, {"name": "ARGS:url", "type": "exists"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data AJAX action url parameter", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-13999-02": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0177\\\\.|0x7f|2130706433|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data targeting localhost/internal IPs", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-14000-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[restrict\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [restrict] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14000-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[register_form\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [register_form] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14001-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14001-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action2", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action2 parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14030-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14032-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14032-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14039-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_client_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_client_name meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|</?(?:iframe|object|embed|form|input|textarea|button|select|details|marquee)[\\\\s/>])~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_link meta field (HTML injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via javascript protocol in _simple_folio_item_link href", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14049-01": {"action": "admin_post_nopriv_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on unauthenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-14049-02": {"action": "admin_post_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on authenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-1405-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[show_products"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[show_products\\\\s[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1405", "description": "Product Catalog Simple <=1.7.11 Stored XSS via show_products shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-type-x", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.7.11"}, "RULE-CVE-2025-1405-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "[show_products"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[show_products\\\\s[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1405", "description": "Product Catalog Simple <=1.7.11 Stored XSS via show_products shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-type-x", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.7.11"}, "RULE-CVE-2025-1405-03": {"action": "init", "conditions": [{"name": "ARGS:product_order", "type": "detectXSS"}], "cve": "CVE-2025-1405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1405", "description": "Product Catalog Simple <=1.7.11 Reflected XSS via product_order parameter on product listing pages", "mode": "block", "severity": 5.4, "slug": "post-type-x", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=1.7.11"}, "RULE-CVE-2025-14050-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:import", "type": "equals", "value": "design-import-export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14050", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14050", "description": "Design Import/Export <=2.2 authenticated (Administrator+) SQL injection via XML file import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "design-import-export", "tags": ["sql-injection", "authenticated", "file-upload"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-14056-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cptui_tools"}, {"name": "ARGS:cptui_post_import", "type": "regex", "value": "~<[a-zA-Z!/][^>]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_post_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-14056-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cptui_tools"}, {"name": "ARGS:cptui_tax_import", "type": "regex", "value": "~<[a-zA-Z!/][^>]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_tax_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-1406-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-1406-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in REST content field", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-14061-01": {"ajax_action": "gdpr_delete_policy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14061", "description": "WP Cookie Consent <=4.0.7 missing authorization on gdpr_delete_policy_data AJAX handler allowing unauthenticated arbitrary post deletion", "mode": "block", "severity": 5.3, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "arbitrary-post-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-14064-01": {"ajax_action": "get_board", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_board AJAX endpoint allows unauthorized access to any group task board", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-02": {"ajax_action": "add_new_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_new_task AJAX endpoint allows unauthorized task creation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-03": {"ajax_action": "edit_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_task AJAX endpoint allows unauthorized task modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-04": {"ajax_action": "delete_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on delete_task AJAX endpoint allows unauthorized task deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-05": {"ajax_action": "reorder_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on reorder_task AJAX endpoint allows unauthorized task reordering", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-06": {"ajax_action": "get_tasks", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_tasks AJAX endpoint allows unauthorized task data access", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-07": {"ajax_action": "edit_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_list AJAX endpoint allows unauthorized list modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-08": {"ajax_action": "users_autocomplete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on users_autocomplete AJAX endpoint allows unauthorized user enumeration", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-09": {"ajax_action": "add_users_to_assign_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_users_to_assign_list AJAX endpoint allows unauthorized user assignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14069-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14069-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on user-edit profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14071-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~[OC]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-14071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14071", "description": "Live Composer <=2.0.2 PHP Object Injection via dslc-ajax-save-composer AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14071-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[dslc_module_(?:posts|projects|partners|staff|testimonials|galleries)_output\\\\][^\\\\[]*[OC]:\\\\d+:~"}], "cve": "CVE-2025-14071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14071", "description": "Live Composer <=2.0.2 PHP Object Injection via post_content containing dslc_module shortcode", "method": "POST", "mode": "block", "severity": 7.5, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14071-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[dslc_module_(?:posts|projects|partners|staff|testimonials|galleries)_output\\\\][^\\\\[]*[OC]:\\\\d+:~"}], "cve": "CVE-2025-14071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14071", "description": "Live Composer <=2.0.2 PHP Object Injection via REST API post content containing dslc_module shortcode", "method": "POST", "mode": "block", "severity": 7.5, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14079-01": {"ajax_action": "eh_crm_ticket_general", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14079", "description": "ELEX WordPress HelpDesk & Customer Support Ticket System <=3.3.5 missing authorization on eh_crm_ticket_general AJAX settings update", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2025-14109-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14109-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14110-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(list-pages|child-pages|tree-pages)\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:<|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14110", "description": "WP Js List Pages Shortcodes <=1.21 stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-js-list-pages-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.21"}, "RULE-CVE-2025-14112-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14112-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14113-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14113-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14114-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14114-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[atvc_video_play\\\\b[^\\\\]]*(?:on[a-zA-Z]+=|javascript:|<script|data:[a-zA-Z]+/[a-zA-Z]+;base64)~i"}], "cve": "CVE-2025-14119", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14119", "description": "App Landing Template Blocks for WPBakery <=2.0.2 stored XSS via atvc_video_play shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "app-template-blocks-for-wpbakery-page-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14119-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[atvc_video_play\\\\b[^\\\\]]*(?:on[a-zA-Z]+=|javascript:|<script|data:[a-zA-Z]+/[a-zA-Z]+;base64)~i"}], "cve": "CVE-2025-14119", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14119", "description": "App Landing Template Blocks for WPBakery <=2.0.2 stored XSS via atvc_video_play shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "app-template-blocks-for-wpbakery-page-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14120-01": {"ajax_action": "bfu_chunker", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg[z]?(?:\\\\.|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14120", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14120", "description": "URL Image Importer <=1.0.7 authenticated (Author+) stored XSS via SVG file upload in bfu_chunker AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "url-image-importer", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-14122-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sliding_faq\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b|<embed\\\\b|<object\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14122", "description": "AD Sliding FAQ <=2.4 Stored XSS via sliding_faq shortcode attributes in post content (admin post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-sliding-faq", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2025-14122-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sliding_faq\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b|<embed\\\\b|<object\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14122", "description": "AD Sliding FAQ <=2.4 Stored XSS via sliding_faq shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-sliding-faq", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2025-14124-01": {"ajax_action": "ttp_Layout_Ajax_Action", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:^|[\'\\"])\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-14124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14124", "description": "Team \\u2013 Team Members Showcase <=5.0.10 unauthenticated SQL injection via search parameter in ttp_Layout_Ajax_Action AJAX handler", "method": "POST", "mode": "block", "severity": 8.6, "slug": "tlp-team", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14142-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[electric-enquiry\\\\b[^\\\\]]*button\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[<>]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14142", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14142", "description": "Electric Enquiries <=1.1 Stored XSS via button attribute of electric-enquiry shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "electric-enquiries", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-14143-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute containing javascript URI in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute with tag injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (event handler)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14144-01": {"ajax_action": "ajax_live_preview", "conditions": [{"name": "ARGS:shortcodeData", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseout|mousemove|keydown|keyup|keypress|submit|change|input|animationend|animationstart)\\\\s*=~i"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via shortcodeData in ajax_live_preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14144-02": {"ajax_action": "mstoic_shortcodes_print_images", "conditions": [{"name": "ARGS:mstoicImgCount", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via mstoicImgCount in mstoic_shortcodes_print_images AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14147-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14147-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14151-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:outbound_resource", "type": "regex", "value": "~(?i)(?:<\\\\s*(?:script|svg)\\\\b|\\\\bon(?:load|error)\\\\s*=|\\\\bjavascript\\\\s*:)~"}], "cve": "CVE-2025-14151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14151", "description": "SlimStat Analytics <=5.3.2 unauthenticated stored XSS via outbound_resource parameter in slimtrack AJAX action", "mode": "block", "severity": 6.1, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.2"}, "RULE-CVE-2025-14154-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~join_chat$~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14154", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14154", "description": "Better Messages <=2.10.2 stored XSS via unauthenticated guest display name in join chat", "method": "POST", "mode": "block", "severity": 6.1, "slug": "bp-better-messages", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-14156-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fox-lms/v1/payments/create-order(/|\\\\?|&|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-14156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14156", "description": "Fox LMS >=1.0.4.7 <=1.0.5.1 unauthenticated privilege escalation via role parameter in create-order REST endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fox-lms", "tags": ["privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.0.4.7 <=1.0.5.1"}, "RULE-CVE-2025-14172-01": {"ajax_action": "cwpp_trigger_flush_rewrite_rules", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14172", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14172", "description": "WP Page Permalink Extension <=1.5.4 missing authorization on cwpp_trigger_flush_rewrite_rules AJAX action allows Subscriber+ to flush rewrite rules", "mode": "block", "severity": 6.5, "slug": "change-wp-page-permalinks", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-14293-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2025-14293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14293", "description": "WP Job Portal <=2.4.0 authenticated arbitrary file read via path traversal in filename parameter", "mode": "block", "severity": 6.5, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-read", "local-file-inclusion"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-14298-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*</style>~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php, event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*<script~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php, script tag injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*</style>~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (style breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*<script~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (script tag injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14344-01": {"ajax_action": "gfmu_delete_file", "conditions": [{"name": "ARGS:file_id", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-14344", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gf-multi-uploader", "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-14344-02": {"ajax_action": "gfmu_delete_file", "conditions": [{"name": "ARGS:tmp_name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-14344", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gf-multi-uploader", "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-14348-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wemail/v1/csv(/|\\\\?|$)~"}, {"name": "REQUEST_HEADERS:x-wemail-user", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14348", "description": "weMail <=2.0.7 unauthenticated information disclosure via x-wemail-user header spoofing on REST CSV endpoints", "method": "GET", "mode": "block", "severity": 5.3, "slug": "wemail", "tags": ["improper-authorization", "information-disclosure", "unauthenticated", "rest-api", "header-spoofing"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-14351-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:bcf_google_font_delete_all", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14351", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14351", "description": "Custom Fonts <=2.1.16 unauthenticated font directory deletion via bcf_google_font_delete_all", "method": "GET", "mode": "block", "severity": 5.3, "slug": "custom-fonts", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.1.16"}, "RULE-CVE-2025-14351-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:bcf_google_font_delete", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14351", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14351", "description": "Custom Fonts <=2.1.16 unauthenticated single font deletion via bcf_google_font_delete", "method": "GET", "mode": "block", "severity": 5.3, "slug": "custom-fonts", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.1.16"}, "RULE-CVE-2025-14351-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:bcf_rebuild_fonts", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14351", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14351", "description": "Custom Fonts <=2.1.16 unauthenticated font rebuild triggering theme.json rewrite via bcf_rebuild_fonts", "method": "GET", "mode": "block", "severity": 5.3, "slug": "custom-fonts", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.1.16"}, "RULE-CVE-2025-14375-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:className", "type": "detectXSS"}], "cve": "CVE-2025-14375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14375", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via className parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.1, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14383-01": {"ajax_action": "WPBC_AJX_CALENDAR_LOAD", "conditions": [{"name": "ARGS:dates_to_check", "type": "detectSQLi"}], "cve": "CVE-2025-14383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14383", "description": "Booking Calendar <=10.14.8 unauthenticated SQL injection via dates_to_check parameter in WPBC_AJX_CALENDAR_LOAD AJAX handler", "mode": "block", "severity": 7.5, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=10.14.8"}, "RULE-CVE-2025-14386-01": {"ajax_action": "generate_sso_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on generate_sso_url AJAX handler allows Subscriber+ to extract admin SSO token", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-02": {"ajax_action": "validate_sso_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on validate_sso_token AJAX handler allows Subscriber+ to validate/consume admin SSO token", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-03": {"ajax_action": "check_sso_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on check_sso_status AJAX handler allows Subscriber+ to query SSO status", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14388-01": {"action": "init", "conditions": [{"name": "ARGS:phast", "type": "exists"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:%00|%2500|\\\\x00)~"}], "cve": "CVE-2025-14388", "method": "GET", "mode": "block", "severity": 9.8, "slug": "phastpress", "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-1440-01": {"ajax_action": "aip_map_url_action", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://)~i"}], "cve": "CVE-2025-1440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1440", "description": "Advanced iFrame <=2024.5 unauthenticated URL mapping injection via aip_map_url_action - blocks non-HTTP(S) scheme URLs (javascript, data, ftp, etc.)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "advanced-iframe", "tags": ["improper-input-validation", "option-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2024.5"}, "RULE-CVE-2025-1441-01": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_no_results", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_no_results param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-02": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_number_of_words param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-03": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_view_result_text param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-04": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_ajax_search_link_target param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-05": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:grid_settings", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (grid_settings JSON param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-14437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-action=download~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-module=~i"}], "cve": "CVE-2025-14437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14437", "description": "Hummingbird Performance <=3.18.0 unauthenticated log file download via Logger::process_actions wphb-log-action parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hummingbird-performance", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "log-file-download"], "target": "plugin", "versions": "<=3.18.0"}, "RULE-CVE-2025-14440-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "jay_login_register_switch_back"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14440", "method": "GET", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.4.01"}, "RULE-CVE-2025-14441-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popupkit/v1/subscribers(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14441", "description": "PopupKit (Starter Templates & Starter Blocks for Starter Sites) <=2.2.0 missing authorization on DELETE /popupkit/v1/subscribers REST endpoint allows authenticated subscriber+ arbitrary subscriber data deletion", "method": "DELETE", "mode": "block", "severity": 5.3, "slug": "popup-builder-block", "tags": ["missing-authorization", "broken-access-control", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14442-01": {"ajax_action": "ays_sccp_results_export_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_file AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14442-02": {"ajax_action": "ays_sccp_results_export_filter", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_filter AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14445-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "points_image"}, {"name": "ARGS", "type": "regex", "value": "~(?:PHNjcmlwdD|PGltZyBzcmM9eCBvbmVycm9y|PGltZyBzcmM9eCBvbm|b25sb2FkPQ|b25lcnJvcj|b25jbGljaz|b25tb3VzZW92ZXI9|amF2YXNjcmlwdDo|PHN2Zy|PGJvZHkgb25sb2Fk|PGRldGFpbHMgb3Blbg|PGlmcmFtZSBzcmNkb2M)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 stored XSS via pointdata custom field on points_image post type save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14445-02": {"ajax_action": "devvn_ihotspot_clone_point", "conditions": [{"type": "missing_capability", "value": "edit_posts"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 missing authorization on devvn_ihotspot_clone_point AJAX handler allows authenticated users to clone hotspot posts", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14446-01": {"ajax_action": "easynotify_cp_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14446", "description": "Popup Builder (Easy Notify Lite) <=1.1.37 missing authorization on easynotify_cp_reset AJAX action allows authenticated Subscriber+ users to reset plugin settings", "mode": "block", "severity": 6.5, "slug": "easy-notify-lite", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2025-14448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)profile\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on profile.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)user-edit\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on user-edit.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14450-01": {"ajax_action": "change_wallet_fund_request_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14450", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14450", "description": "Wallet System for WooCommerce <=2.7.2 missing authorization on change_wallet_fund_request_status AJAX action allows Subscriber+ to manipulate wallet balances", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wallet-system-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2025-14452-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "wpcr3_review"}, {"name": "ARGS:wpcr3_fname", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|focus|click|mouseover|mouseout|keydown|keyup|change|submit|blur|dblclick|input|resize)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14452", "description": "WP Customer Reviews <=3.7.5 reflected XSS via wpcr3_fname parameter on admin review list", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-customer-reviews", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.7.5"}, "RULE-CVE-2025-14453-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*style_css\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via style_css shortcode attribute breakout into event handlers", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14453-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*margin\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via margin shortcode attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14453-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*padding\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via padding shortcode attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14453-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*border_color\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via border_color shortcode attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14455-01": {"ajax_action": "delete_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on delete_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-02": {"ajax_action": "clone_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on clone_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-03": {"ajax_action": "update_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on update_gallery_configuration AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-04": {"ajax_action": "save_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on save_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-05": {"ajax_action": "delete_image", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on delete_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-06": {"ajax_action": "add_image", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on add_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-07": {"ajax_action": "add_new_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on add_new_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-08": {"ajax_action": "save_image", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on save_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-09": {"ajax_action": "sort_images", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on sort_images AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-10": {"ajax_action": "toggle_visibility", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on toggle_visibility AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-11": {"ajax_action": "assign_filters", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on assign_filters AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-12": {"ajax_action": "assign_group", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on assign_group AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-13": {"ajax_action": "save_video", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on save_video AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-14": {"ajax_action": "refresh_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on refresh_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14467-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:wpjobportalme", "type": "equals", "value": "job"}, {"name": "ARGS:description", "type": "regex", "value": "~<script[\\\\s/>]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14467-02": {"action": "init", "conditions": [{"name": "ARGS:wpjobportalme", "type": "equals", "value": "job"}, {"name": "ARGS:description", "type": "regex", "value": "~<script[\\\\s/>]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14477-01": {"ajax_action": "ajaxUpdatePaginationLinks", "conditions": [{"name": "ARGS:filterText", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:SELECT|DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|/\\\\*[^*]*\\\\*/\\\\s*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2025-14477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14477", "description": "404 Solution <=3.1.0 authenticated (Admin+) SQL injection via filterText parameter in ajaxUpdatePaginationLinks AJAX action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "404-solution", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-14506-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:post_content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14508-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mediacommander/v1/import-csv(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14508", "description": "MediaCommander <=2.3.1 missing authorization on import-csv REST endpoint allows Author+ to delete all media folder data", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mediacommander", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-1453-01": {"ajax_action": "save-widget", "conditions": [{"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (AJAX save-widget path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-1453-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/widgets\\\\.php~"}, {"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (classic widgets.php POST path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-14533-01": {"ajax_action": "nopriv_endpoint/form/shortcode", "conditions": [{"type": "missing_capability", "value": "promote_users"}, {"name": "ARGS", "type": "regex", "value": "~^(?:administrator|super_admin)$~"}], "cve": "CVE-2025-14533", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.1"}, "RULE-CVE-2025-14539-01": {"ajax_action": "shortcode_ajax", "conditions": [{"name": "ARGS:code", "type": "regex", "value": "~\\\\[[a-zA-Z_][^\\\\]]*\\\\]~"}], "cve": "CVE-2025-14539", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14539", "description": "Shortcode Ajax <=1.0 unauthenticated arbitrary shortcode execution via code parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcode-ajax", "tags": ["code-injection", "arbitrary-shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14548-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_title", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_title", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-1455-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget settings on Elementor REST save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-1455-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:_elementor_data", "type": "contains", "value": "wpr-woo-grid"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:popup_notification_animation|popup_notification_fade_out_in|popup_notification_animation_duration|element_open_links_in_new_tab)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\\\"|&quot;)(?:\\\\s)*(?:on[a-z]{3,20}\\\\s*=|>[^<]{0,200}<\\\\s*(?:script|svg|img|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget in _elementor_data on classic editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-14552-01": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-title", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-title in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14552-02": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-description", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-description in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14554-01": {"ajax_action": "orderform_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-z/!?]~i"}], "cve": "CVE-2025-14554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14554", "description": "Sell BTC - Cryptocurrency Selling Calculator <=1.5 unauthenticated stored XSS via orderform_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sell-btc-by-hayyatapps", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-14555-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdevart_countdown\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14555", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14555", "description": "Countdown Timer - Widget Countdown <=2.7.7 Stored XSS via wpdevart_countdown shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-countdown", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.7"}, "RULE-CVE-2025-14555-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdevart_countdown\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14555", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14555", "description": "Countdown Timer - Widget Countdown <=2.7.7 Stored XSS via wpdevart_countdown shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-countdown", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.7"}, "RULE-CVE-2025-1457-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~element_pack_wrapper_link~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:javascript)\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)~i"}], "cve": "CVE-2025-1457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1457", "description": "Element Pack Addons <=5.10.28 Stored DOM XSS via Wrapper Link javascript:/data: URI in Elementor widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.10.28"}, "RULE-CVE-2025-1457-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ep_countdown_redirect_link~"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"[\\\\s\\\\S]*?(?:javascript)\\\\s*:|(?:javascript)\\\\s*:[\\\\s\\\\S]*?\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"|\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"[\\\\s\\\\S]*?data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)[\\\\s\\\\S]*?\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"~i"}], "cve": "CVE-2025-1457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1457", "description": "Element Pack Addons <=5.10.28 Stored DOM XSS via Countdown redirect URL javascript:/data: URI in Elementor widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.10.28"}, "RULE-CVE-2025-1458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[\\\\s>]|[\'\\"]javascript\\\\s*:|on(?:error|load|click|mouseover|focus|mouse(?:over|out|enter|move))\\\\s*[=|]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1458", "description": "Element Pack Addons for Elementor <=5.10.29 Stored XSS via Elementor widget settings in post editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-addon"], "target": "plugin", "versions": "<=5.10.29"}, "RULE-CVE-2025-1459-01": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-02": {"ajax_action": "so_panels_builder_content_json", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content JSON preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-03": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in live editor preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-14610-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"csv_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via csv_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14610-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"json_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via json_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14627-01": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|\\\\[f[cd])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - direct internal/private IP in url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "internal-network-access"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14627-02": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://bit\\\\.ly/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - bit.ly redirect bypass to internal endpoints", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "redirect-bypass"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14632-01": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~\\\\.html?(?:[\\"\'\\\\s,}]|$)~i"}], "cve": "CVE-2025-14632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14632", "description": "Filr - Secure document library <=1.2.11 stored XSS via HTML file upload through chunked upload path (_chunkedd parameter)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "filr-protection", "tags": ["file-upload", "xss", "dangerous-file-type"], "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2025-14635-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:ha_page_custom_js", "type": "detectXSS"}], "cve": "CVE-2025-14635", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "target": "plugin", "versions": "<=3.20.3"}, "RULE-CVE-2025-14657-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v1/[^/]+/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14657", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "target": "plugin", "versions": "<=4.0.51"}, "RULE-CVE-2025-14718-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow creation REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow update REST endpoint", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow deletion REST endpoint", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+/publish(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow publish REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14720-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~refund~i"}, {"name": "ARGS", "type": "regex", "value": "~payment_id~i"}], "cve": "CVE-2025-14720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14720", "description": "Amelia Booking <=2.0 unauthenticated Square refund webhook forgery via missing signature verification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ameliabooking", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "webhook-forgery"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14732-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14732", "description": "Elementor <=3.35.5 stored XSS via REST API meta _elementor_data field", "mode": "block", "severity": 6.4, "slug": "elementor", "tags": ["stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.35.5"}, "RULE-CVE-2025-14736-01": {"ajax_action": "frontend_admin/form_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor)$~i"}], "cve": "CVE-2025-14736", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.28.25"}, "RULE-CVE-2025-14736-02": {"ajax_action": "frontend_admin/validate_form_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor)$~i"}], "cve": "CVE-2025-14736", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.28.25"}, "RULE-CVE-2025-14736-03": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor)$~i"}], "cve": "CVE-2025-14736", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.28.25"}, "RULE-CVE-2025-14745-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|<svg[^>]*/?\\\\s*>|<img[^>]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized template parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-02": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:className", "type": "regex", "value": "~(?:[\\"\'][\\\\s>]|<[a-z]+[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized className parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-03": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:/^(?:source|sources|feeds|exclude|category|folders)$/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|<svg[^>]*/?\\\\s*>|<img[^>]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized source/sources/feeds/exclude/category/folders parameters in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-1475-01": {"ajax_action": "wpcom_login", "conditions": [{"name": "ARGS:user_phone", "type": "exists"}], "cve": "CVE-2025-1475", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "target": "plugin", "versions": "<=1.7.5"}, "RULE-CVE-2025-14757-01": {"ajax_action": "complete_payment", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14757", "description": "Cost Calculator Builder <=3.6.9 missing authorization on complete_payment AJAX action allows unauthenticated order status manipulation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-14770-01": {"action": "init", "conditions": [{"name": "ARGS:shipping_city", "type": "detectSQLi"}], "cve": "CVE-2025-14770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14770", "description": "Shipping Rate By Cities <=2.0.0 unauthenticated SQL injection via shipping_city parameter during WooCommerce checkout", "method": "POST", "mode": "block", "severity": 7.5, "slug": "shipping-rate-by-cities", "tags": ["sql-injection", "unauthenticated", "woocommerce-checkout"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-14770-02": {"action": "init", "conditions": [{"name": "ARGS:billing_city", "type": "detectSQLi"}], "cve": "CVE-2025-14770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14770", "description": "Shipping Rate By Cities <=2.0.0 unauthenticated SQL injection via billing_city parameter during WooCommerce checkout", "method": "POST", "mode": "block", "severity": 7.5, "slug": "shipping-rate-by-cities", "tags": ["sql-injection", "unauthenticated", "woocommerce-checkout"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-14785-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "seedprod_lite_save_lpage"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14785", "description": "Website Builder by SeedProd (coming-soon) <=6.20.2 contributor+ stored XSS via seedprodnestedmenuwidget shortcode attributes saved through seedprod_lite_save_lpage", "method": "POST", "mode": "block", "severity": 6.4, "slug": "coming-soon", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.20.2"}, "RULE-CVE-2025-14785-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "seedprod_lite_save_template"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14785", "description": "Website Builder by SeedProd (coming-soon) <=6.20.2 contributor+ stored XSS via seedprodnestedmenuwidget shortcode attributes saved through seedprod_lite_save_template", "method": "POST", "mode": "block", "severity": 6.4, "slug": "coming-soon", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.20.2"}, "RULE-CVE-2025-14793-01": {"action": "init", "conditions": [{"name": "ARGS:dkpdfg", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14793", "description": "DK PDF <=2.3.0 authenticated (Author+) SSRF via PDF generation trigger (dkpdfg parameter)", "method": "GET", "mode": "block", "severity": 5.0, "slug": "dk-pdf", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-14796-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "attachment"}, {"name": "ARGS:post_title", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core post.php attachment edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14796-02": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[title]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core save-attachment AJAX", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:tag-name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term creation (tag-name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14797-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editedtag"}, {"name": "ARGS:name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term edit (name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14799-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailin/v1/mailin_disconnect(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14799", "description": "Brevo (Mailin) <=3.3.0 unauthenticated authorization bypass via type juggling on mailin_disconnect REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mailin", "tags": ["authorization-bypass", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-14800-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/wpcf7r/v1/download-file(/|\\\\?|$)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)(wp-config\\\\.php|php\\\\.ini|\\\\.htaccess|\\\\.user\\\\.ini)(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)([^/]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx))(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(\\\\.\\\\./|\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|/etc/passwd|/windows/win\\\\.ini)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~^(https?|ftp)://[^\\\\s]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx)(\\\\?.*)?$~i"}], "cve": "CVE-2025-14800", "method": "GET", "mode": "block", "severity": 8.1, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-14803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_update_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|&lt;|&#0*60;?|&#x0*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14803-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_insert_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|&lt;|&#0*60;?|&#x0*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14804-01": {"ajax_action": "wpfm_delete_file", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_delete_file AJAX action (IDOR, no ownership check)", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "arbitrary-file-deletion", "idor"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14804-02": {"ajax_action": "wpfm_save_file_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_save_file_data path traversal in filename", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["path-traversal", "arbitrary-file-deletion", "file-name-manipulation"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14842-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:phar|svg)(?:\\\\s|$)~i"}], "cve": "CVE-2025-14842", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14842", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.2 \\u2013 best-effort block of .phar/.svg strings in POST/GET params on upload AJAX (NOTE: does not inspect multipart filenames in $_FILES; partial coverage only)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["dangerous-file-upload", "unauthenticated", "cwe-434", "partial-coverage"], "target": "plugin", "versions": "<=1.3.9.2"}, "RULE-CVE-2025-14844-01": {"ajax_action": "rcp_stripe_create_setup_intent_for_saved_card", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14844", "description": "Restrict Content <=3.2.16 unauthenticated Stripe SetupIntent client_secret leak via rcp_stripe_create_setup_intent_for_saved_card AJAX action (IDOR/Missing Auth)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authentication", "idor", "sensitive-data-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.2.16"}, "RULE-CVE-2025-14855-02": {"ajax_action": "validation_ajax_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|math|details|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer[a-z]*)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-14855", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14855", "description": "SureForms <=2.2.0 unauthenticated stored XSS via validation AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14865-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*headline\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode headline attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14865-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*acf\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script|\\"\\\\s+\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode acf attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14867-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via path traversal in post_content shortcode source attribute", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via REST API post creation with path traversal in content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14875-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "hblpay_return"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on wc-api callback", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-14875-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~hblpay-payment-gateway-for-woocommerce/return\\\\.php~"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on direct return.php access", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-1489-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-1489-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post_content param (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-14891-01": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:displayName", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14891", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14891", "description": "Customer Reviews for WooCommerce <=5.93.1 Stored XSS via displayName in cr_local_forms_submit AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.93.1"}, "RULE-CVE-2025-14893-01": {"action": "init", "conditions": [{"name": "ARGS:tel", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-14893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14893", "description": "IndieWeb <=4.0.5 Stored XSS via Telephone profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "indieweb", "tags": ["xss", "stored-xss", "user-profile"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-1490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smart-maintenance-mode"}, {"name": "ARGS:setstatus", "type": "detectXSS"}], "cve": "CVE-2025-1490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1490", "description": "Smart Maintenance Mode <=1.5.2 reflected XSS via setstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "smart-maintenance-mode", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-14937-01": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:load|error|click|mouseover|focus|blur|mouseout|mousemove|mouseenter|dblclick|keydown|keyup|change|submit|reset|select|abort)\\\\s*=|\\\\b(?:href|src|data|action)\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-14937", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14937", "description": "Frontend Admin by DynamiApps <=3.28.23 unauthenticated stored XSS via acff parameter in update_field AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.28.23"}, "RULE-CVE-2025-14948-01": {"ajax_action": "mo_wc_notification_enable", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:notification", "type": "exists"}], "cve": "CVE-2025-14948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14948", "description": "OTP Verification & SMS Notification <=4.3.8 missing authorization on mo_wc_notification_enable AJAX action allows unauthenticated notification settings toggle", "method": "POST", "mode": "block", "severity": 5.3, "slug": "miniorange-sms-order-notification-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2025-14973-01": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[0][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[0][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-02": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[1][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[1][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-03": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[2][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[2][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14975-02": {"action": "wp_loaded", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rp"}, {"name": "ARGS:pass1", "type": "exists"}, {"name": "ARGS:rp_key", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14975", "description": "Login Customizer <=2.5.3 unauthenticated arbitrary password reset via rp action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "login-customizer", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "password-reset"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-14976-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^user-registration~"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:post", "type": "regex", "value": "~^\\\\d+$~"}], "cve": "CVE-2025-14976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14976", "description": "User Registration & Membership <=4.4.8 CSRF to arbitrary post deletion via process_row_actions delete action", "method": "GET", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["csrf", "arbitrary-post-deletion", "missing-nonce"], "target": "plugin", "versions": "<=4.4.8"}, "RULE-CVE-2025-14977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to read other vendors\' store settings", "method": "GET", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to modify other vendors\' store settings including payment info", "method": "POST", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "account-takeover"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14983-01": {"ajax_action": "ACFFA_delete_icon_set", "conditions": [{"name": "ARGS:icon_set_name", "type": "regex", "value": "~<[^>]*(?:script|img|svg|iframe|object|embed|link|style|form|input|body|meta|marquee|details|math|isindex|base|area)|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseenter|mouseleave|mouseout|mousemove|dblclick|contextmenu|wheel|pointerover|animationend|toggle|resize|beforeunload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}], "cve": "CVE-2025-14983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14983", "description": "Advanced Custom Fields: Font Awesome <=5.0.1 Stored XSS via ACFFA_delete_icon_set icon_set_name parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-font-awesome", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2025-14985-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~</style\\\\s*>~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14985-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~</style\\\\s*>~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14997-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/members/.+/profile/edit/)~"}, {"name": "ARGS:/^field_\\\\d+$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 path traversal payload injection via xprofile field value during BuddyPress profile save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14997-02": {"ajax_action": "bpxcftr_remove_user_tag", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 missing authorization on bpxcftr_remove_user_tag AJAX action (defense-in-depth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14998-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:rp|resetpass)$~i"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-14998-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-activate\\\\.php~"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-15019-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:bialty_cs_alt", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change|submit|keyup|keydown)\\\\s*=)~i"}], "cve": "CVE-2025-15019", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15019", "description": "BIALTY - Bulk Image Alt Text with Yoast SEO + WooCommerce <=2.2.1 authenticated stored XSS via bialty_cs_alt post meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bulk-image-alt-text-with-yoast", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-1502-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "download_ip2location_redirection_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1502", "description": "IP2Location Redirection <=1.33.3 unauthenticated settings export via download_ip2location_redirection_backup action in admin_init", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ip2location-redirection", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.33.3"}, "RULE-CVE-2025-15027-01": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_capabilities", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15027-02": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_user_level", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1503-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][name]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe Name field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-02": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][link]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe link field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][credit]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe credit field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-04": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][button]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe button field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-05": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][image_url]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe image_url field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-15030-01": {"action": "init", "conditions": [{"name": "ARGS:passw1", "type": "exists"}, {"name": "ARGS:passw2", "type": "exists"}, {"name": "ARGS:loginName", "type": "exists"}, {"name": "ARGS:key", "type": "exists"}, {"name": "ARGS:finalAction", "type": "equals", "value": "yes"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15030", "description": "Profile Builder <=3.15.1 unauthenticated account takeover via password reset bypass", "method": "POST", "mode": "block", "severity": 9.8, "slug": "profile-builder", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.15.1"}, "RULE-CVE-2025-15041-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/save_site_option(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15041", "method": "POST", "mode": "block", "severity": 7.2, "slug": "backwpup", "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2025-15057-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15057", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15057", "description": "SlimStat Analytics <=5.3.3 unauthenticated stored XSS via fh parameter in slimtrack AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2025-15058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pricing_table"}, {"name": "ARGS:table_currency", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15058", "description": "Responsive Pricing Table <=5.1.12 authenticated (Contributor+) Stored XSS via table_currency parameter in pricing_table CPT", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dk-pricr-responsive-pricing-table", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=5.1.12"}, "RULE-CVE-2025-1507-01": {"action": "init", "conditions": [{"name": "ARGS:ga_action", "type": "regex", "value": "~^ga_action_(auth|sharethis_invite|update_terms|enable_all_features|disable_all_features)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1507", "description": "ShareThis Dashboard for Google Analytics <=3.2.1 missing authorization on handle_actions() allows unauthenticated feature deactivation", "mode": "block", "severity": 5.3, "slug": "googleanalytics", "tags": ["missing-authorization", "unauthenticated", "feature-deactivation"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-15100-01": {"ajax_action": "jay_login_register_create_final_user", "conditions": [{"name": "ARGS:/(?i)^meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15100-03": {"ajax_action": "jay_panel_update_profile", "conditions": [{"name": "ARGS:/(?i)^jay_panel_meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1511-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ur-member~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1511", "description": "User Registration & Membership <=4.0.4 Reflected XSS via search parameter on membership admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1513-01": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Name", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Name field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-1513-02": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Comment", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Comment field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-15260-01": {"ajax_action": "lws_adminpanel_editlist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15260", "description": "MyRewards \\u2013 Loyalty Points and Rewards for WooCommerce <=5.6.0 missing authorization on lws_adminpanel_editlist allowing subscriber+ to modify loyalty rules", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woorewards", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2025-15266-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_frontendajax chat message", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-15266-02": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_ajax chat handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-1527-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Gutenberg REST API post update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "rest-api"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:save_builder|elementor_ajax)$~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "elementor"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-15283-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "exists"}, {"name": "ARGS:name_directory_name", "type": "regex", "value": "~(?:<|&lt;?|&#0*60;?|&#x0*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|&gt;?|&#0*62;?|&#x0*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|&#0*106;?avascript\\\\s*:|&#x0*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "exists"}, {"name": "ARGS:name_directory_description", "type": "regex", "value": "~(?:<|&lt;?|&#0*60;?|&#x0*3[cC];?)(?:script|svg|iframe|body|marquee|object|embed|math)(?:[\\\\s/>]|&gt;?|&#0*62;?|&#x0*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|&#0*106;?avascript\\\\s*:|&#x0*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_description parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-03": {"action": "init", "conditions": [{"name": "ARGS:name_directory_submitter", "type": "exists"}, {"name": "ARGS:name_directory_submitter", "type": "regex", "value": "~(?:<|&lt;?|&#0*60;?|&#x0*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|&gt;?|&#0*62;?|&#x0*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|&#0*106;?avascript\\\\s*:|&#x0*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_submitter parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15285-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post modification via REST API", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post deletion via REST API", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-deletion"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/category(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated category creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15347-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15347", "method": "POST", "mode": "block", "severity": 8.8, "slug": "creatorlms", "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2025-15368-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15368-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15386-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<a\\\\s[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with inline event handler in anchor tag", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<a\\\\s[^>]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with javascript URI in anchor href", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<a\\\\s[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with inline event handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<a\\\\s[^>]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with javascript URI", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15396-01": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-error-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-error-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15396-02": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-success-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-success-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15403-01": {"ajax_action": "rm_user_exists", "conditions": [{"name": "ARGS:admin_order", "type": "exists"}], "cve": "CVE-2025-15403", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2025-15440-02": {"ajax_action": "custom_form_submit", "conditions": [{"name": "ARGS:product_image", "type": "regex", "value": "~(?:^\\\\s*(?:javascript|data|vbscript)\\\\s*:|\\"\\\\s*(?:on[a-z]+=|>|/\\\\s*>))~i"}], "cve": "CVE-2025-15440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15440", "description": "iONE360 configurator <=2.0.57 unauthenticated stored XSS via product_image attribute injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ione360-configurator", "tags": ["xss", "stored-xss", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=2.0.57"}, "RULE-CVE-2025-15466-01": {"ajax_action": "delete_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-02": {"ajax_action": "clone_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on clone_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-03": {"ajax_action": "add_new_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_new_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-04": {"ajax_action": "save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-05": {"ajax_action": "get_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-06": {"ajax_action": "get_image_size_url", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_image_size_url AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-07": {"ajax_action": "delete_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-08": {"ajax_action": "save_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-09": {"ajax_action": "add_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-10": {"ajax_action": "sort_images", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on sort_images AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-11": {"ajax_action": "assign_filters", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_filters AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-12": {"ajax_action": "toggle_visibility", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on toggle_visibility AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-13": {"ajax_action": "assign_group", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_group AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-14": {"ajax_action": "update_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on update_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-15": {"ajax_action": "refresh_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on refresh_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-16": {"ajax_action": "save_video", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_video AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15477-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-post\\\\.php)~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15477-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15482-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~^chapa_proceed$~i"}, {"name": "ARGS:callback_url", "type": "exists"}, {"name": "ARGS:tx_ref", "type": "exists"}, {"name": "ARGS:amount", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2025-15482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15482", "description": "Chapa Payment Gateway for WooCommerce <=1.0.3 unauthenticated sensitive information exposure (secret_key) via wc-api=chapa_proceed endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "chapa-payment-gateway-for-woocommerce", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-15521-01": {"ajax_action": "academy/shortcode/password_reset_handler", "cve": "CVE-2025-15521", "method": "POST", "mode": "block", "severity": 9.8, "slug": "academy", "target": "plugin", "versions": "<=3.5.0"}, "RULE-CVE-2025-15522-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (post save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-15522-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-1560-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wee [^]]*(?:on[a-zA-Z]+=|javascript:|<script)~i"}], "cve": "CVE-2025-1560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1560", "description": "WOW Entrance Effects (WEE) <=0.1 Stored XSS via [wee] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-entrance-effects-wee", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-1560-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]wee [^]]*(?:on[a-zA-Z]+=|javascript:|<script)~i"}], "cve": "CVE-2025-1560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1560", "description": "WOW Entrance Effects (WEE) <=0.1 Stored XSS via [wee] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-entrance-effects-wee", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-1561-01": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:title", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via title parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-02": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:var", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via var parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-03": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:file", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via file parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-04": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:function", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via function parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-05": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:line", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via line parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1562-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/funnelkit-automations/v[0-9]+/plugin/install_and_activate~"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-1562", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2025-1571-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|save_builder)$~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:exad_animated_text|exad_image_comparison|image.comparison)~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?i)(?:<\\\\s*script\\\\b|on(?:error|load)\\\\s*=|javascript:|<\\\\s*svg\\\\b)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1571", "description": "Exclusive Addons for Elementor <=2.7.6 authenticated (Contributor+) Stored XSS via Animated Text and Image Comparison widget settings", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2025-1572-01": {"ajax_action": "ajax_get", "conditions": [{"name": "ARGS:u_id", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-1572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1572", "description": "KiviCare \\u2013 Clinic & Patient Management System (EHR) <=3.6.7 authenticated SQL injection via u_id parameter in ajax_get AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-1572-02": {"ajax_action": "ajax_post", "conditions": [{"name": "ARGS:u_id", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-1572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1572", "description": "KiviCare \\u2013 Clinic & Patient Management System (EHR) <=3.6.7 authenticated SQL injection via u_id parameter in ajax_post AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-1620-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "floating-button"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|</\\\\s*style\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via floating-button settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "branding"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|</\\\\s*style\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via branding settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "banner-settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|</\\\\s*style\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via banner-settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1625-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:<script[\\\\s>]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1625-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:<script[\\\\s>]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1626-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1662-01": {"ajax_action": "url_media_uploader_url_upload", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:localhost|\\\\[?::1\\\\]?|0(?:\\\\.0){0,3}|127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0x[0-9a-f]{8}|[0-9]{8,10})(?:[:/]|$))~i"}], "cve": "CVE-2025-1662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1662", "description": "URL Media Uploader <=1.0.0 authenticated SSRF via url parameter in url_media_uploader_url_upload AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "url-media-uploader", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-1664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post create)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post update)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (classic editor post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "classic-editor"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1670-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpsp-exams"}, {"name": "ARGS:cid", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-1670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1670", "description": "WPSchoolPress <=2.2.16 authenticated SQL injection via cid parameter on wpsp-exams admin page", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wpschoolpress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=2.2.16"}, "RULE-CVE-2025-1670-02": {"ajax_action": "GetClass", "conditions": [{"name": "ARGS:cid", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-1670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1670", "description": "WPSchoolPress <=2.2.16 authenticated SQL injection via cid parameter in GetClass AJAX handler", "mode": "block", "severity": 6.5, "slug": "wpschoolpress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=2.2.16"}, "RULE-CVE-2025-1670-03": {"ajax_action": "GetClassYear", "conditions": [{"name": "ARGS:cid", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-1670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1670", "description": "WPSchoolPress <=2.2.16 authenticated SQL injection via cid parameter in GetClassYear AJAX handler", "mode": "block", "severity": 6.5, "slug": "wpschoolpress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=2.2.16"}, "RULE-CVE-2025-1702-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~\'\\\\s*(?:OR|AND|UNION)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|--\\\\s*$|/\\\\*~i"}], "cve": "CVE-2025-1702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1702", "description": "Ultimate Member <=2.10.0 unauthenticated SQL injection via search parameter in member directory AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.10.0"}, "RULE-CVE-2025-1703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s>/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1703-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s>/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1717-01": {"action": "init", "conditions": [{"name": "ARGS:lmn", "type": "exists"}], "cve": "CVE-2025-1717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1717", "description": "Login Me Now <=1.7.2 unauthenticated authentication bypass via transient-based auto-login (lmn parameter)", "method": "GET", "mode": "block", "severity": 8.1, "slug": "login-me-now", "tags": ["authentication-bypass", "unauthenticated", "missing-authentication"], "target": "plugin", "versions": "<=1.7.2"}, "RULE-CVE-2025-1730-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~(?:(?:\\\\\\\\.\\\\\\\\.[\\\\\\\\\\\\/]){2,}|^/etc/|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) arbitrary file read via sdc_download post creation with malicious sdc_download_path", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "missing-authorization", "path-traversal"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-02": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~^(?:file://|php://|expect://|data://|glob://|phar://|ssh2://|ogg://|zlib://|rar://|zip://|ftp://|dict://|gopher://|ldap://|telnet://|smtp://|imap://|pop3://|http://(?:127\\\\.|0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|localhost|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) SSRF/arbitrary file read via sdc_download post creation with malicious remote URL", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "ssrf", "missing-authorization"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-03": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) capability bypass - non-admin creating sdc_download posts", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1766-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1766-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint (PATCH method)", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1768-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^sq_(ajax_)?(assistant|audits|bulkseo|focuspages|onboarding|post|saveseo)$~i"}, {"name": "ARGS:skeyword", "type": "regex", "value": "~\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+UNION(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(?:ALL(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+)?SELECT|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*[\\\\d(]|\'\\\\s*;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(IF|SLEEP|EXTRACTVALUE|BENCHMARK)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*\\\\(~i"}], "cve": "CVE-2025-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1768", "description": "Squirrly SEO <=12.4.05 authenticated blind SQL injection via skeyword parameter in AJAX search handlers", "method": "POST", "mode": "block", "severity": 6.5, "slug": "squirrly-seo", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=12.4.05"}, "RULE-CVE-2025-1783-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-02": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post partial update (PATCH)", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1784-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:uagb/[a-z0-9-]+\\\\s+\\\\{[^}]*\\"block_id\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*(?:\\\\\\\\.[^\\"\\\\\\\\]*)*\\"[^}]*\\\\}\\\\s*-->[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (post.php entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1784-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<!--\\\\s*wp:uagb/[a-z0-9-]+\\\\s+\\\\{[^}]*\\"block_id\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*(?:\\\\\\\\.[^\\"\\\\\\\\]*)*\\"[^}]*\\\\}\\\\s*-->[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (REST API entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1785-01": {"ajax_action": "wpdm_newfile", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-1785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1785", "description": "Download Manager <=3.3.08 authenticated (Author+) path traversal via wpdm_newfile AJAX action allowing limited file overwrite", "method": "POST", "mode": "block", "severity": 8.1, "slug": "download-manager", "tags": ["path-traversal", "file-overwrite", "authenticated"], "target": "plugin", "versions": "<=3.3.08"}, "RULE-CVE-2025-1802-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\']marker_title[\\"\']\\\\s*[:\\\\,]\\\\s*[\\"\'][^\\"\']*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|on(?:error|load|click|mouseover|focus|blur|animationend)\\\\s*=)~i"}], "cve": "CVE-2025-1802", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1802", "description": "HT Mega for Elementor <=2.8.3 Stored XSS via Google Map widget marker_title parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ht-mega-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2025-1802-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\']notification_content[\\"\']\\\\s*[:\\\\,]\\\\s*[\\"\'][^\\"\']*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|on(?:error|load|click|mouseover|focus|blur|animationend)\\\\s*=)~i"}], "cve": "CVE-2025-1802", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1802", "description": "HT Mega for Elementor <=2.8.3 Stored XSS via Notify widget notification_content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ht-mega-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2025-1802-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~stt_button_text[\\"\':=\\\\s]+[^}\\"&]*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|on(?:error|load|click|mouseover|focus|blur|animationend)\\\\s*=)~i"}], "cve": "CVE-2025-1802", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1802", "description": "HT Mega for Elementor <=2.8.3 Stored XSS via Scroll-to-Top stt_button_text parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ht-mega-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2025-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:$|[/?])~i"}, {"name": "ARGS:bb_social_login", "type": "equals", "value": "apple"}], "cve": "CVE-2025-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1909", "description": "BuddyBoss Platform Pro <=2.7.01 Apple OAuth authentication bypass (CWE-288) \\u2014 web flow wp-login.php?bb_social_login=apple", "method": "POST", "mode": "block", "severity": 9.8, "slug": "buddyboss-platform-pro", "target": "plugin", "versions": "<=2.7.01"}, "RULE-CVE-2025-1912-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wt_iew_export_download", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via export download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-02": {"action": "admin_init", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}, {"name": "ARGS:page", "type": "regex", "value": "~^wt-iew-(?:history|export)$~"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via history/export page download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-03": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:file_url", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via iew_import_ajax_basic validate_file", "method": "POST", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1971-01": {"ajax_action": "iew_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in export AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-1971-02": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in import AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-2004-01": {"ajax_action": "wpe_delete_file", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e[%2f/\\\\\\\\]|%252e%252e%252f)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2004", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2004", "description": "Simple WP Events <=1.8.17 unauthenticated arbitrary file deletion via wpe_delete_file AJAX action", "method": "POST", "mode": "block", "severity": 9.1, "slug": "simple-wp-events", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.8.17"}, "RULE-CVE-2025-2005-01": {"action": "init", "conditions": [{"name": "ARGS:ewd-feup-action", "type": "equals", "value": "register"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|ps|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\.|$)|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2025-2005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2005", "description": "Front End Only Users <=3.2.32 unauthenticated arbitrary file upload via registration form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "front-end-only-users", "tags": ["arbitrary-file-upload", "unauthenticated", "rce"], "target": "plugin", "versions": "<=3.2.32"}, "RULE-CVE-2025-2005-02": {"action": "init", "conditions": [{"name": "ARGS:ewd-feup-action", "type": "equals", "value": "update"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|ps|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\.|$)|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2025-2005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2005", "description": "Front End Only Users <=3.2.32 unauthenticated arbitrary file upload via profile update form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "front-end-only-users", "tags": ["arbitrary-file-upload", "unauthenticated", "rce"], "target": "plugin", "versions": "<=3.2.32"}, "RULE-CVE-2025-2009-01": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber name field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2009-02": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber email field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2025-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:view", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2025-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:tab", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mappress_maps"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-zA-Z]+=|<script[\\\\s/>]|<iframe[\\\\s/>]|javascript\\\\s*:|<svg[\\\\s/][^>]*\\\\bon[a-zA-Z]+=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2055", "description": "MapPress Maps for WordPress <=2.94.8 authenticated (Contributor+) stored XSS via map marker fields on admin page", "method": "POST", "mode": "block", "severity": 6.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.94.8"}, "RULE-CVE-2025-2056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via REQUEST_URI in showFile (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-03": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url parameter (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-04": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)~"}, {"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url targeting sensitive files", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2083-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in wp-admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2109-01": {"action": "init", "conditions": [{"name": "ARGS:css", "type": "regex", "value": "~^(?:https?://|//|ftp://|file://|php://|phar://|data://|expect://|glob://)~i"}], "cve": "CVE-2025-2109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2109", "description": "WP Compress <=6.30.15 unauthenticated SSRF via css query parameter in init hook", "mode": "block", "severity": 5.8, "slug": "wp-compress-image-optimizer", "tags": ["ssrf", "unauthenticated", "file-get-contents"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-01": {"ajax_action": "wps_ic_saveSetting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_saveSetting AJAX handler allows Subscriber+ to modify plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-02": {"ajax_action": "wps_ic_get_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_get_setting AJAX handler allows Subscriber+ to read plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-03": {"ajax_action": "wps_ic_settings_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_settings_change AJAX handler allows Subscriber+ to alter plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-04": {"ajax_action": "wpc_ic_checkCFConnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFConnect AJAX handler allows Subscriber+ to overwrite Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-05": {"ajax_action": "wpc_ic_checkCFDisconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFDisconnect AJAX handler allows Subscriber+ to delete Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-06": {"ajax_action": "wpc_ic_set_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_set_mode AJAX handler allows Subscriber+ to change plugin operation mode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-07": {"ajax_action": "wps_ic_purge_cdn", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_cdn AJAX handler allows Subscriber+ to purge CDN cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-08": {"ajax_action": "wps_ic_purge_html", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_html AJAX handler allows Subscriber+ to purge HTML cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-09": {"ajax_action": "wpc_ic_start_bulk_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_restore AJAX handler allows Subscriber+ to trigger bulk image restore", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-10": {"ajax_action": "wpc_ic_start_bulk_compress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_compress AJAX handler allows Subscriber+ to trigger bulk image compression", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-11": {"ajax_action": "wps_ic_save_excludes_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_save_excludes_settings AJAX handler allows Subscriber+ to modify exclude settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-12": {"ajax_action": "wps_lite_connect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_lite_connect AJAX handler allows Subscriber+ to connect plugin to external API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-13": {"ajax_action": "wps_ic_cname_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_cname_add AJAX handler allows Subscriber+ to add CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-14": {"ajax_action": "wps_ic_remove_cname", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_cname AJAX handler allows Subscriber+ to remove CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-15": {"ajax_action": "wps_ic_remove_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_key AJAX handler allows Subscriber+ to remove plugin API key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2111-02": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"name": "ARGS:page", "type": "equals", "value": "wpb-debug"}], "cve": "CVE-2025-2111", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2111", "description": "WP Headers And Footers <=3.1.1 CSRF to arbitrary options update via debug page POST request (set_option_name/option_value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-headers-and-footers", "tags": ["csrf", "arbitrary-option-update", "privilege-escalation"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-2128-01": {"ajax_action": "ccb_update_order", "conditions": [{"name": "ARGS:order_ids", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2128", "description": "Cost Calculator Builder <=3.2.67 authenticated SQL injection via order_ids parameter in Payments::update_payment_status_by_order_ids", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cost-calculator-builder", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=3.2.67"}, "RULE-CVE-2025-2162-01": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized width setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "settings-injection"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2162-02": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:base_font_size", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized base_font_size setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "style-breakout"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2164-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:sortby", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via sortby parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via post_id parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:pixelstats_page", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via pixelstats_page parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:last_day", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via last_day parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2166-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cm-faq($|-)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\'`]\\\\s*>\\\\s*<|<\\\\s*(?:script|svg|img|iframe|object|embed|body|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2166", "description": "CM FAQ <=1.2.5 Reflected XSS via remove_query_arg without esc_url on admin page URL", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cm-faq", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-2167-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[events_list\\\\b[^\\\\]]*(?:before_title|title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|<details[^>]+\\\\bontoggle\\\\s*=|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2167", "description": "Event Post <=5.9.9 Stored XSS via events_list shortcode attributes (before_title, title, after_title) in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "event-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2025-2186-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bwfan_get_automation_wc_dynamic_coupon"}, {"name": "ARGS:automationId", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2186", "description": "FunnelKit Automations <=3.5.1 unauthenticated SQL injection via automationId parameter in bwfan_get_automation_wc_dynamic_coupon AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-marketing-automations", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-2203-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/funnelkit-app/funnel-analytics/\\\\d+/contacts~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:\'[\\\\s)]*(?:UNION[\\\\s/\\\\*]+SELECT|OR[\\\\s/\\\\*]+[\'\\"]?\\\\w+[\'\\"]?\\\\s*[=<>]|AND[\\\\s/\\\\*]+[\'\\"]?\\\\w+|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)|INTO[\\\\s/\\\\*]+(?:OUT|DUMP)FILE|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE|UPDATEXML|LOAD_FILE))~i"}], "cve": "CVE-2025-2203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2203", "description": "FunnelKit Funnel Builder <=3.10.1 authenticated SQL injection via search parameter in funnel analytics contacts REST endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "funnel-builder", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2025-2221-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_login"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated time-based SQL injection via user_phone parameter in wpcom_login AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_register"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_register AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_send_sms_code"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_send_sms_code AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_lostpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_lostpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_resetpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_resetpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-06": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_accountbind"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_accountbind AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\"rael_title_tag\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<\\\\s*(?:script|img|svg|iframe|body|marquee|details|math|a\\\\b|div\\\\s|input)[^\\"]*|\\\\bon(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=)[^\\"]*\\"~i"}], "cve": "CVE-2025-2225", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2225", "description": "Responsive Addons for Elementor <=1.6.9 Stored XSS via rael_title_tag in Icon Box widget (post.php save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2025-2228-01": {"action": "init", "conditions": [{"name": "ARGS:rael-register-submit", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}, {"name": "ARGS:page_id", "type": "exists"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2025-2228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2228", "description": "Responsive Addons for Elementor <=1.6.8 sensitive information exposure via register_user \\u2014 blocks registration form submissions for users lacking create_users capability. NOTE: This also blocks anonymous self-registration on vulnerable versions as a protective measure.", "method": "POST", "mode": "block", "severity": 5.7, "slug": "responsive-addons-for-elementor", "tags": ["sensitive-information-exposure", "credential-leak"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-22295-01": {"ajax_action": "tripetto_submit", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~<script[^>]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated form submission (tripetto_submit snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22295-02": {"ajax_action": "tripetto_pause", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~<script[^>]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated paused form data (tripetto_pause snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22317-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpape-gallery-settings"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:onfocus|onload|onerror|onmouseover|onclick)\\\\s*=)~i"}], "cve": "CVE-2025-22317", "description": "Gallery Images Ape <=2.2.8 reflected XSS via tab parameter on admin settings page", "mode": "block", "severity": 7.1, "slug": "gallery-images-ape", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2025-22349-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:bid_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via bid_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-add"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-add admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-2252-01": {"ajax_action": "edd_get_download_title", "conditions": [{"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:action", "type": "equals", "value": "edd_get_download_title"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:edd_get_download_title", "type": "regex", "value": "~^[0-9]+$~"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7", "author_report.json:file-S6ZFTyHKyXhYs5pWZxQcgo"], "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2252", "mode": "block", "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.6.1"}, "RULE-CVE-2025-2257-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "boldgrid-backup-settings"}, {"name": "ARGS:compression_level", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2257", "description": "Total Upkeep \\u2013 BoldGrid Backup <=1.16.10 authenticated OS command injection via compression_level setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "boldgrid-backup", "tags": ["command-injection", "authenticated", "settings-update"], "target": "plugin", "versions": "<=1.16.10"}, "RULE-CVE-2025-2269-01": {"ajax_action": "editimage_bwg", "conditions": [{"name": "ARGS:image_id", "type": "regex", "value": "~[<>\\"\'()]~"}], "cve": "CVE-2025-2269", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2269", "description": "Photo Gallery by 10Web <=1.8.34 reflected XSS via image_id in editimage_bwg AJAX handler", "mode": "block", "severity": 6.1, "slug": "photo-gallery", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.8.34"}, "RULE-CVE-2025-2270-01": {"action": "init", "conditions": [{"name": "ARGS:ycd_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data|expect|glob|ogg)://)~i"}], "cve": "CVE-2025-2270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2270", "description": "Countdown Builder <=2.8.9.1 unauthenticated Local File Inclusion via ycd_type parameter in RegisterPostType::createCdObj", "mode": "block", "severity": 8.1, "slug": "countdown-builder", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.8.9.1"}, "RULE-CVE-2025-22735-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via unsanitized $_SERVER[\'REQUEST_URI\'] in admin settings view templates", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~on(?:error|load|click|focus|mouseover|mouseout|submit|change|input|keydown|keyup)\\\\s*=~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via event handler injection in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:img|svg|iframe|body|embed|object|video|audio|details|math|marquee)[\\\\s/]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via HTML tag injection (img/svg/iframe/body/embed/object) in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22800-01": {"action": "admin_post_regenerate-qrcode", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "regenerate-qrcode"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-22800", "mode": "block", "severity": 8.8, "slug": "post-smtp", "target": "plugin", "versions": ">=2.8.3 <=2.9.11"}, "RULE-CVE-2025-2299-01": {"ajax_action": "lwptoc_block_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_edit AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2299-02": {"ajax_action": "lwptoc_block_view", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_view AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2302-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2314-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2314-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2317-01": {"ajax_action": "woo_product_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\'[) ]*(?:/[*][^*]*[*]/[ ]*)*(?:UNION(?:[ ]+|/[*][^*]*[*]/)(?:ALL(?:[ ]+|/[*][^*]*[*]/))?SELECT|(?:OR|AND)(?:[ ]+|/[*][^*]*[*]/)(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|[0-9]+[ ]*=[ ]*[0-9]))~i"}], "cve": "CVE-2025-2317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2317", "description": "Product Filter by WBW <=2.7.9 unauthenticated SQL injection via filtersDataBackend parameter in woo_product_filter AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woo-product-filter", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.7.9"}, "RULE-CVE-2025-2319-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_USER", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_USER parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:db_date", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in db_date parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_NAME", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_NAME parameter used in backup shell commands", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:Download_SQL_Backup", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|\\\\x0d|\\\\x0a)~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to path traversal and header injection via Download_SQL_Backup parameter", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "path-traversal", "header-injection"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_PASSWORD", "type": "regex", "value": "~[;`|\\\\x0a\\\\x0d]|\\\\$\\\\(~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell injection constructs in DB_PASSWORD parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_HOST", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_HOST parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2328-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+~"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary file deletion via path traversal in dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2328-02": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary sensitive file deletion via dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2330-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in _elementor_data (post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-2330-02": {"action": "init", "conditions": [{"name": "ARGS:elements", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in elements param (Elementor AJAX save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-23843-01": {"action": "init", "conditions": [{"name": "ARGS:filter_designation", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_designation parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-02": {"action": "init", "conditions": [{"name": "ARGS:filter_department", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_department parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-03": {"action": "init", "conditions": [{"name": "ARGS:filter_employment_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_employment_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-04": {"action": "init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via orderby parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-05": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via order parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-06": {"action": "init", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via status parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-07": {"action": "init", "conditions": [{"name": "ARGS:post_mime_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via post_mime_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-08": {"action": "init", "conditions": [{"name": "ARGS:detached", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via detached parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-09": {"action": "init", "conditions": [{"name": "ARGS:search_employee", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via search_employee parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-10": {"action": "init", "conditions": [{"name": "ARGS:from", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via from parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-11": {"action": "init", "conditions": [{"name": "ARGS:to", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via to parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-12": {"action": "init", "conditions": [{"name": "ARGS:filter_duration", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_duration parameter in audit log", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23942-01": {"ajax_action": "wpgallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wpgallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-02": {"ajax_action": "wplg_edit_gallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wplg_edit_gallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-03": {"ajax_action": "wplg_loadmore_gallery", "conditions": [{"name": "ARGS:options", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via options parameter in wplg_loadmore_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-04": {"ajax_action": "wplg_navigation_gallery", "conditions": [{"name": "ARGS:gallery_id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via gallery_id parameter in wplg_navigation_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-24000-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/post-smtp/v1/logs/[^/]+/resend(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 post-smtp/v1/logs/{id}/resend REST endpoint callable by non-admin users, allowing abuse of password reset emails.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs", "resend"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/email-count(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/email-count REST endpoint accessible to non-admin users.", "method": "GET", "mode": "block", "severity": 6.5, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/minimize-maximize-ad(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/minimize-maximize-ad REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/get-failed-logs(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/get-failed-logs REST endpoint accessible to non-admin users, exposing failed email log contents.", "method": "GET", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/open-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/open-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/remove-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/remove-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24563-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:user_name_search", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via user_name_search parameter in author-search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-04": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-05": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-06": {"action": "template_redirect", "conditions": [{"name": "ARGS:dir_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via dir_id parameter in claim.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-07": {"action": "template_redirect", "conditions": [{"name": "ARGS:package_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via package_id parameter in wizard-style-2.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24573-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|change|input|submit|keydown|keyup|pointerover|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-24573", "description": "PageLayer <=1.9.4 contributor+ stored XSS via pagelayer_save_content AJAX handler", "mode": "block", "severity": 6.5, "slug": "pagelayer", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2025-24587-01": {"ajax_action": "getEmailTemplate", "conditions": [{"name": "ARGS:entrant", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,.*,|CASE\\\\s+WHEN\\\\s+.*\\\\s+THEN\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24587", "description": "Email Subscription Popup <=1.2.23 authenticated blind SQL injection via entrant parameter in getEmailTemplate AJAX handler", "mode": "block", "severity": 7.6, "slug": "email-subscribe", "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-24601-01": {"action": "init", "conditions": [{"name": "ARGS:dn-listener", "type": "equals", "value": "paypal"}, {"name": "ARGS:custom", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-24601", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24601", "description": "FundPress <=2.0.6 unauthenticated PHP object injection via PayPal IPN custom parameter", "mode": "block", "severity": 9.8, "slug": "fundpress", "tags": ["object-injection", "deserialization", "unauthenticated", "paypal-ipn"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-24648-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:login_redirect_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 privilege escalation via login_redirect_url in profile update", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-02": {"ajax_action": "save_custom_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-03": {"ajax_action": "save_custom_menu_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_menu_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-04": {"ajax_action": "save_hidden_menu_items", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_hidden_menu_items AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24677-01": {"ajax_action": "pp_wpspin_import_json", "conditions": [{"name": "FILES:pp_wpspin_import_json_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 authenticated remote code execution via arbitrary file write in pp_wpspin_import_json AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["remote-code-execution", "arbitrary-file-write", "code-injection"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24677-02": {"ajax_action": "pp_wpspin_export_json", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 missing authorization on pp_wpspin_export_json allows authenticated users to export arbitrary posts via IDOR", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24752-01": {"action": "init", "conditions": [{"name": "ARGS:popup-selector", "type": "regex", "value": "~[<>\\"\'(){}]|javascript\\\\s*:|on(?:error|load|focus|click|mouseover|mouseout|keyup|keydown|submit|change|input|blur)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|body|details|marquee|video|audio|form|math|base)~i"}], "cve": "CVE-2025-24752", "method": "GET", "mode": "block", "severity": 6.1, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.14"}, "RULE-CVE-2025-24753-01": {"ajax_action": "kadence_import_get_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-02": {"ajax_action": "kadence_import_reload_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-03": {"ajax_action": "kadence_import_get_new_connection_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-04": {"ajax_action": "kadence_import_get_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-05": {"ajax_action": "kadence_import_reload_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-06": {"ajax_action": "kadence_import_get_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-07": {"ajax_action": "kadence_import_reload_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-08": {"ajax_action": "kadence_import_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-09": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-10": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-11": {"ajax_action": "kadence_subscribe_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-2478-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-edit"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 time-based blind SQL injection via snippetId on snippet-edit admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2478-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-delete"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 SQL injection via snippetId on snippet-delete admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2481-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mediaview"}, {"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2025-2481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2481", "description": "MediaView <=1.1.2 Reflected Cross-Site Scripting via id parameter on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mediaview", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2484-01": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:video_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via video_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-02": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:group_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via group_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-03": {"ajax_action": "mvob_add_videos_to_groups", "conditions": [{"name": "ARGS:add_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via add_videos in mvob_add_videos_to_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-04": {"ajax_action": "mvob_remove_videos_from_groups", "conditions": [{"name": "ARGS:remove_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via remove_videos in mvob_remove_videos_from_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2513-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*(?:embed|object|iframe|foreignObject))~i"}], "cve": "CVE-2025-2513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2513", "description": "Smart Icons For WordPress <=1.0.4 authenticated stored XSS via SVG file upload - blocks non-admin SVG uploads containing XSS patterns", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smartifw", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-2537-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nggallery-manage-gallery"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form|svg|math)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-2537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2537", "description": "NextGEN Gallery <=3.59.11 Stored DOM-Based XSS via image metadata in manage gallery page", "method": "POST", "mode": "block", "severity": 6.4, "slug": "nextgen-gallery", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.59.11"}, "RULE-CVE-2025-2540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2540-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|products?)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto", "rest-api"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2543-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/async-upload\\\\.php|/wp-admin/upload\\\\.php)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:svg|svgz)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through async-upload.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2543-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?|)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through REST media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "rest-api"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2563-01": {"ajax_action": "user_registration_user_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-2563", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-2576-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress media uploader (admin-ajax.php upload-attachment)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2576-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/async-upload\\\\.php(?:\\\\?|$)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress async-upload.php endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2579-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/async-upload.php"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:json|lottie)$~i"}], "cve": "CVE-2025-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2579", "description": "Lottie Player <=1.1.8 Stored XSS via malicious .json/.lottie file upload through async-upload.php (blocks uploads matching patch behavior of 1.2.0)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-lottie-player", "tags": ["xss", "stored-xss", "file-upload", "authenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-2580-01": {"ajax_action": "bitforms_submit_form", "conditions": [{"name": "ARGS:attachment_name", "type": "regex", "value": "~\\\\.svg(?:$|[\\\\s\\"\'&?#])~i"}], "cve": "CVE-2025-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2580", "description": "Bit Form <= 2.18.3 Stored XSS via SVG file upload through bitforms_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bit-form", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=2.18.3"}, "RULE-CVE-2025-2594-01": {"ajax_action": "user_registration_membership_confirm_payment", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"name": "ARGS:auto_login", "type": "regex", "value": "~^(?:true|1|yes|on)$~i"}], "cve": "CVE-2025-2594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2594", "description": "User Registration & Membership <=4.1.2 authentication bypass via membership_confirm_payment AJAX action with auto_login parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["authentication-bypass", "idor", "unauthenticated", "account-takeover"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-2635-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-activations"}, {"name": "ARGS:license-id", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped license-id parameter on Activations admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2635-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-licenses"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped search parameter on Licenses admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2636-01": {"action": "init", "conditions": [{"name": "ARGS:instawp-database-manager", "type": "exists"}, {"name": "ARGS:instawp-database-manager", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|php://|data://|expect://|zip://|phar://)~i"}], "cve": "CVE-2025-2636", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.85"}, "RULE-CVE-2025-26592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26592-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26763-04": {"ajax_action": "ms_import_others", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^ms_import_others$~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-26763", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-26763", "description": "MetaSlider <=3.94.0 PHP Object Injection via ms_import_others AJAX handler", "mode": "block", "severity": 9.8, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.94.0"}, "RULE-CVE-2025-2685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "tablepress"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:table-name", "type": "detectXSS"}], "cve": "CVE-2025-2685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2685", "description": "TablePress <=3.0.4 Authenticated (Author+) Stored XSS via table-name parameter on admin form POST", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-27007-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sure-triggers/v1/automation/action(/|\\\\?|&|$)~"}, {"name": "ARGS:type_event", "type": "equals", "value": "create_user_if_not_exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-27007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.0.82"}, "RULE-CVE-2025-27012-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with users_can_register option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-27012-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with default_role option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-2719-01": {"ajax_action": "swatchly_notices", "conditions": [{"name": "ARGS:noticeid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2719", "description": "Swatchly <=1.4.0 missing authorization on swatchly_notices AJAX action allows Subscriber+ to update arbitrary options to true", "method": "POST", "mode": "block", "severity": 6.5, "slug": "swatchly", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-27270-01": {"ajax_action": "suspend_automatic_detection", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-27270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27270", "description": "Residential Address Detection <=2.5.4 unauthenticated arbitrary option update via suspend_automatic_detection AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "residential-address-detection", "tags": ["missing-authorization", "arbitrary-option-update", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-2779-01": {"ajax_action": "htscript_notices", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on htscript_notices AJAX action allows arbitrary option update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2779-02": {"ajax_action": "ihafs_diagnostic_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on ihafs_diagnostic_data AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2800-01": {"ajax_action": "add_organizer", "conditions": [{"name": "ARGS:organizer_name", "type": "detectXSS"}], "cve": "CVE-2025-2800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2800", "description": "WP Event Manager <=3.1.50 unauthenticated stored XSS via organizer_name in add_organizer AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-event-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.50"}, "RULE-CVE-2025-2801-01": {"ajax_action": "abcsubmit_form_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[.+\\\\]~s"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2801", "description": "ABCSubmit <=1.2.3 unauthenticated arbitrary shortcode execution via abcsubmit_form_preview AJAX handler", "method": "POST", "mode": "block", "severity": 7.3, "slug": "abcsubmit", "tags": ["code-injection", "arbitrary-shortcode", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-2805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~[[][a-z][a-z0-9_-]{2,} [^]]*=[^]]*[]]~"}], "cve": "CVE-2025-2805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2805", "description": "ORDER POST <=2.0.2 unauthenticated arbitrary shortcode execution via comment text containing shortcode syntax", "method": "POST", "mode": "block", "severity": 7.3, "slug": "order-post", "tags": ["code-injection", "shortcode-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-2807-01": {"ajax_action": "mvl_setup_wizard_install_plugin", "conditions": [{"name": "ARGS:plugin", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-2807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2807", "description": "Motors - Car Dealership & Classified Listings <= 1.4.64 missing authorization on mvl_setup_wizard_install_plugin allowing Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.64"}, "RULE-CVE-2025-2816-01": {"ajax_action": "pvc_yellow_message_dontshow", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2816", "description": "Page View Count <=2.8.4 missing authorization on pvc_yellow_message_dontshow AJAX handler allows arbitrary option update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "page-views-count", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=2.8.4"}, "RULE-CVE-2025-2821-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings modification endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2821-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings read endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2839-01": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-02": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-03": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-04": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 script tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-05": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-06": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2889-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_type", "type": "equals", "value": "link_library_links"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on[a-zA-Z0-9_]+ *=|xmlns|style *=[ ]*[\\"\'][^\\"\']*(?:expression|url) *\\\\()|< *(?:script|iframe|object|embed|form|svg|math|base|link|meta)|javascript *:|data *: *text/html~i"}], "cve": "CVE-2025-2889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2889", "description": "Link Library <=7.7.3 Authenticated (Contributor+) Stored XSS via Link Additional Parameters on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "link-library", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.7.3"}, "RULE-CVE-2025-2893-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in classic editor post submission", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-28983-01": {"ajax_action": "CNPCF_cnpgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-02": {"ajax_action": "CNPCF_friendlyname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_friendlyname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-03": {"ajax_action": "CNPCF_cnpaccountid", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpaccountid AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-04": {"ajax_action": "CNPCF_cnpchnlgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpchnlgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-05": {"ajax_action": "getCnPUserChannelList", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on getCnPUserChannelList AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-2940-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "contains", "value": "wpf-async-request-"}, {"name": "ARGS:args[url]", "type": "exists"}], "cve": "CVE-2025-2940", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2940", "description": "Ninja Tables <= 5.0.18 unauthenticated SSRF via WPFluent async request handler args[url] parameter", "mode": "block", "severity": 7.2, "slug": "ninja-tables", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=5.0.18"}, "RULE-CVE-2025-2941-01": {"ajax_action": "dnd_codedropz_upload_wc", "conditions": [{"name": "FILES:wc-upload-file[]", "type": "exists"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-2941-02": {"ajax_action": "dnd_codedropz_upload_delete_wc", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.)|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[\\\\\\\\/]))~i"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-3058-01": {"ajax_action": "xwc_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:settings", "type": "exists"}], "cve": "CVE-2025-3058", "method": "POST", "mode": "block", "severity": 8.8, "slug": "xelion-webchat", "target": "plugin", "versions": "<=9.1.0"}, "RULE-CVE-2025-3064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on options.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/network/settings.php"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on network settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wpfront-secondary-roles[administrator]", "type": "exists"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via secondary roles including administrator", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3075-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\bon(?:mouse(?:over|enter|move|out|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|animate(?:end|start|iteration)|transition(?:end|run|start)|pointer(?:over|enter|down|up|move|out)|touch(?:start|end|move))\\\\s*=~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-3075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3075", "description": "Elementor <=3.29.0 Authenticated (Contributor+) Stored XSS via widget settings in elementor_ajax save handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementor", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=3.29.0"}, "RULE-CVE-2025-30772-01": {"ajax_action": "wpcuf_import_export_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 arbitrary option update to privilege escalation via wpcuf_import_export_save AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30772-02": {"ajax_action": "wpcuf_import_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 missing authorization on wpcuf_import_export AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30773-01": {"ajax_action": "trp_save_translations_regular", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_regular strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-02": {"ajax_action": "trp_save_translations_gettext", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_gettext strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-03": {"ajax_action": "trp_update_database", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_update_database AJAX handler", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30911-01": {"ajax_action": "install_requirements", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on install_requirements allows subscriber+ arbitrary plugin installation leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-plugin-install", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-30911-02": {"ajax_action": "import_rtm_template", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on import_rtm_template allows subscriber+ arbitrary file write leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-file-write", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-31019-01": {"action": "init", "conditions": [{"name": "ARGS:mopppm_userid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31019", "method": "POST", "mode": "block", "severity": 8.8, "slug": "password-policy-manager", "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-3102-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:sure-triggers|suretriggers|ottokit)/v1/(?:authenticate-user|automation/action)(?:/|\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:st_authorization", "type": "regex", "value": "~^(?:[\\\\s]*|Bearer[\\\\s]*)$~i"}], "cve": "CVE-2025-3102", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3102", "description": "SureTriggers <=1.0.78 unauthenticated REST API authentication bypass via empty st_authorization header", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.78"}, "RULE-CVE-2025-3106-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"action\\"\\\\s*:\\\\s*\\"save_builder\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"lakit-table-of-contents\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:\\"icon\\"\\\\s*:\\\\s*\\\\{[^{}\\\\r\\\\n]{0,1024}\\"value\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\\\\\r\\\\n]{0,256}(?:\\\\\\\\\\"|\\\\\\\\u0022)[^\\"\\\\r\\\\n]{0,128}\\\\bon[a-z][a-z0-9_:-]*\\\\s*=|&(?:lt|\\\\#0*60|\\\\#x0*3c);\\\\s*(?:script(?=\\\\s|&(?:gt|\\\\#0*62|\\\\#x0*3e);)|(?:img|svg|iframe|object|embed|details|math|video|audio|body)\\\\b[^\\\\r\\\\n]{0,512}?\\\\bon[a-z][a-z0-9_:-]*\\\\s*=))~ix"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3106", "description": "LA-Studio Element Kit for Elementor <=1.4.9 authenticated stored XSS via unsanitized Table of Contents list text or icon value in Elementor save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2025-3107-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in post_content (classic editor POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PUT)", "method": "PUT", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-31081-01": {"action": "attachment_submitbox_misc_actions", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-31081", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-31081", "description": "Enable Media Replace <=4.1.5 reflected XSS via unescaped get_post_meta output in admin_date_replaced_media_on_edit_media_screen (classes/emr-plugin.php:614-620); exact reflected request parameter and write-site are unresolved in current artefacts, capability-scoped minimal rule pending further evidence", "mode": "block", "severity": 7.1, "slug": "enable-media-replace", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=4.1.5"}, "RULE-CVE-2025-31560-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "salon-customers"}, {"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02A": {"ajax_action": "salon", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02B": {"ajax_action": "salon", "conditions": [{"name": "ARGS:user_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-32118-01": {"ajax_action": "cmp_ajax_upload_font", "conditions": [{"name": "FILES:font_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-32118", "description": "CMP Coming Soon & Maintenance <=4.1.14 authenticated arbitrary file upload via cmp_ajax_upload_font", "mode": "block", "severity": 9.1, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=4.1.14"}, "RULE-CVE-2025-32143-01": {"ajax_action": "accordions_ajax_import_json", "conditions": [{"name": "ARGS:accordions_data", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-32143", "description": "Accordion <=2.3.11 PHP object injection via accordions_data parameter in import handler", "mode": "block", "severity": 8.8, "slug": "accordions", "target": "plugin", "versions": "<=2.3.11"}, "RULE-CVE-2025-32486-01": {"ajax_action": "public_amd_ajax_handler", "conditions": [{"name": "ARGS:reset_password[new_password]", "type": "exists"}, {"name": "ARGS:reset_password[vcode]", "type": "regex", "value": "~^0[eE]\\\\d+$~"}], "cve": "CVE-2025-32486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "material-dashboard", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2025-32568-01": {"ajax_action": "empik_csv_process_emp_log_classes", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_log_classes AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32568-02": {"ajax_action": "empik_csv_process_emp_prod_states", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_prod_states AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32597-01": {"ajax_action": "cdaily", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^A-Za-z0-9_.$]~"}], "cve": "CVE-2025-32597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32597", "description": "Connect Daily Web Calendar <=1.5.4 reflected XSS via unsanitized JSONP callback parameter in cdaily AJAX handler", "mode": "block", "severity": 7.1, "slug": "connect-daily-web-calendar", "tags": ["xss", "csrf", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-32648-01": {"ajax_action": "pto_ajax_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-32648", "method": "POST", "mode": "block", "severity": 9.8, "slug": "projectopia-core", "target": "plugin", "versions": "<=5.1.23"}, "RULE-CVE-2025-32652-01": {"ajax_action": "solace_extra_upload_logo", "conditions": [{"name": "ARGS:logo_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[?#%/]|$)|\\\\.htaccess(?:[?#%/]|$)|\\\\.htpasswd(?:[?#%/]|$)~i"}], "cve": "CVE-2025-32652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32652", "description": "Solace Extra <=1.3.1 arbitrary file upload via solace_extra_upload_logo AJAX handler allowing remote PHP file write", "mode": "block", "severity": 9.9, "slug": "solace-extra", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-32682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapsvg/v[0-9]+/~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-32682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32682", "description": "MapSVG Lite <=8.6.4 authenticated (Contributor+) arbitrary file upload via REST API allowing web shell deployment", "method": "POST", "mode": "block", "severity": 9.9, "slug": "mapsvg-lite-interactive-vector-maps", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "authenticated"], "target": "plugin", "versions": "<=8.6.4"}, "RULE-CVE-2025-3281-01": {"ajax_action": "user_registration_membership_create_stripe_subscription", "conditions": [{"name": "ARGS:member_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 IDOR in create_stripe_subscription allowing unauthenticated user deletion via member_id", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "missing-authorization", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-03": {"ajax_action": "user_registration_membership_verify_pages", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on verify_pages membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-04": {"ajax_action": "user_registration_membership_validate_pg", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on validate_pg membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3418-01": {"ajax_action": "wpcac_edit_save", "conditions": [{"name": "ARGS:field", "type": "regex", "value": "~^(wp_capabilities|wp_user_level|role)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3418", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-admin-columns", "target": "plugin", "versions": ">=2.0.6 <=2.1.0"}, "RULE-CVE-2025-3421-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "evf-entries"}, {"name": "ARGS:form_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:img|svg|iframe|object|embed|math|details|marquee|video|audio|body|input|button|select|textarea|form|isindex|meta|link|style|base|frame|frameset|applet)\\\\b[^>]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\'\\"]?javascript))~i"}], "cve": "CVE-2025-3421", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3421", "description": "Everest Forms <=3.1.1 Reflected Cross-Site Scripting via form_id parameter on admin entries page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "everest-forms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3422-01": {"ajax_action": "everest_forms_form_preview_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3422", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3422", "description": "Everest Forms <=3.1.1 authenticated arbitrary shortcode execution via form_preview_save AJAX action", "method": "POST", "mode": "block", "severity": 6.3, "slug": "everest-forms", "tags": ["missing-authorization", "arbitrary-shortcode-execution", "code-injection"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3428-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3428-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon[a-zA-Z0-9_]+\\\\s*=|<iframe\\\\b|<object\\\\b|<embed\\\\b|<svg[\\\\s/]|javascript\\\\s*:~i"}], "cve": "CVE-2025-3434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3434", "description": "SMTP for Amazon SES YaySMTP <=1.8 unauthenticated stored XSS via comment form email logging", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-3434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon[a-zA-Z0-9_]+\\\\s*=|<iframe\\\\b|<object\\\\b|<embed\\\\b|<svg[\\\\s/]|javascript\\\\s*:~i"}], "cve": "CVE-2025-3434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3434", "description": "SMTP for Amazon SES YaySMTP <=1.8 unauthenticated stored XSS via comment author field email logging", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-3435-01": {"ajax_action": "mb_board", "conditions": [{"name": "ARGS:board_header", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_header parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3435-02": {"ajax_action": "mb_board", "conditions": [{"name": "ARGS:board_footer", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_footer parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3436-01": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via orderby parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3436-02": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via order parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3438-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/(?:register|sign_up|sign_up_2)(/|\\\\?|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!(subscriber|customer|owner|driver)$).+$~"}], "cve": "CVE-2025-3438", "method": "POST", "mode": "block", "severity": 7.3, "slug": "mstore-api", "target": "plugin", "versions": "<4.17.5"}, "RULE-CVE-2025-3439-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3439-02": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3455-01": {"action": "admin_post_start_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated arbitrary file upload via start_restore admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["arbitrary-file-upload", "missing-authorization", "file-upload"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-02": {"action": "admin_post_start_backup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on start_backup admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-03": {"action": "admin_post_cancel_actions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on cancel_actions admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3457-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3457-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:ocean_gallery_id[/[0-9]+/]", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-3458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3458", "description": "Ocean Extra <=2.4.6 stored XSS via unsanitized ocean_gallery_id in gallery metabox", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3468-01": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-02": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-03": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-04": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3471-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sureforms/v1/global-settings(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3471", "description": "SureForms <1.4.4 incorrect authorization on global-settings REST API endpoint allows Contributor+ to update plugin settings", "method": "POST", "mode": "block", "severity": 4.9, "slug": "sureforms", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<1.4.4"}, "RULE-CVE-2025-3487-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[forminator_form[^\\\\]]*\\\\blimit\\\\s*=\\\\s*([\\"\'])[\\\\s\\\\S]*?(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}\\\\s*=|javascript\\\\s*:|&#\\\\d+;|&#x[0-9a-fA-F]+;)[\\\\s\\\\S]*?\\\\1~i"}], "cve": "CVE-2025-3487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3487", "description": "Forminator <=1.42.0 Stored XSS via limit parameter in forminator_list_pagination", "mode": "block", "severity": 5.4, "slug": "forminator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.42.0"}, "RULE-CVE-2025-3515-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "dnd_codedropz_upload"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:phar|pht|phtml|php[0-9]?|phps|php\\\\.[^./]+|inc)$~i"}], "cve": "CVE-2025-3515", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "target": "plugin", "versions": "<=1.3.8.9"}, "RULE-CVE-2025-3516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via post_content attribute injection (classic editor)", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3516-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via REST API post content attribute injection", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3520-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on profile.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3520-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on user-edit.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3597-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in post_content on classic editor", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "post-content"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3597-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in content on REST API posts endpoint", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3614-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript[ ]*:|&#[xX]?[0-9a-fA-F]+;?[a-zA-Z]*script[ ]*:|data[ ]*:[ ]*text/html|on(?:mouse(?:over|enter|move|out|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|dblclick|drag|drop|resize|scroll|unload|beforeunload|pointerover|pointerenter|animationend|transitionend)[ ]*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3614", "description": "ElementsKit Elementor Addons <=3.5.2 Stored XSS via Widget Builder URL control through ekit_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "widget-builder"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-3616-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v1/proxy-api(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-3616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3616", "description": "GreenShift Animation and Page Builder Blocks >=11.4 <=11.4.5 authenticated arbitrary file upload via REST proxy-api endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["arbitrary-file-upload", "missing-authorization", "rest-api", "file-upload"], "target": "plugin", "versions": ">=11.4 <=11.4.5"}, "RULE-CVE-2025-3649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:&#0*58;?|&#x0*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:&#0*58;?|&#x0*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:&#0*58;?|&#x0*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3662-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<a\\\\b[^>]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:&lt;|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 unauthenticated stored XSS via comment submission with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3662-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<a\\\\b[^>]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:&lt;|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 Contributor+ stored XSS via post content with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3703-01": {"ajax_action": "cjtoolbox_get_info_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) local file inclusion via cjtoolbox_get_info_view AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_create AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-03": {"ajax_action": "cjtoolbox_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_delete AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-04": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_set_property AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-05": {"ajax_action": "cjtoolbox_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_restore AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-06": {"ajax_action": "cjtoolbox_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_list AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-07": {"ajax_action": "cjtoolbox_get_revision", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revision AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-08": {"ajax_action": "cjtoolbox_get_revisions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revisions AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3752-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3752-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3761-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(profile|user-edit)\\\\.php~"}, {"name": "ARGS:mt_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3761", "description": "My Tickets <= 2.0.16 authenticated privilege escalation via mt_capabilities in profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "my-tickets", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.16"}, "RULE-CVE-2025-3775-01": {"ajax_action": "woolentor_proxy_image", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?!library\\\\.shoplentor\\\\.com(:[0-9]+)?(/|$|\\\\?))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3775", "description": "ShopLentor (WooLentor) <=3.1.2 unauthenticated SSRF via woolentor_proxy_image AJAX endpoint \\u2014 blocks requests where the url parameter targets any host other than the legitimate library.shoplentor.com", "mode": "block", "severity": 6.5, "slug": "woolentor-addons", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-3779-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ply-widget\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-widget] shortcode attribute in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3779-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ply-placeholder\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-placeholder] shortcode attribute in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3779-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ply-widget\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-widget] shortcode attribute in REST API post content", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3779-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ply-placeholder\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3779", "description": "Personizely <=0.10 Stored XSS via [ply-placeholder] shortcode attribute in REST API post content", "mode": "block", "severity": 6.4, "slug": "personizely", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.10"}, "RULE-CVE-2025-3780-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wcfm-setup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3780", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3780", "description": "WCFM Frontend Manager <=6.7.16 unauthenticated plugin settings modification via admin_init setup redirect", "mode": "block", "severity": 6.5, "slug": "wc-frontend-manager", "tags": ["missing-authorization", "unauthenticated", "settings-tampering"], "target": "plugin", "versions": "<=6.7.16"}, "RULE-CVE-2025-3781-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3781-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in REST API post content", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3782-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3782-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3809-01": {"ajax_action": "log_js_errors", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~(?i)(<\\\\s*script\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3809", "description": "Debug Log Manager <=2.3.4 unauthenticated stored XSS via log_js_errors AJAX error parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "debug-log-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2025-3810-01": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "edit_profile_data"}, {"name": "ARGS:pass1", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-3810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3810", "description": "WPBookit <1.0.3 unauthenticated account takeover via IDOR in edit_profile_data", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpbookit", "tags": ["idor", "account-takeover", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<1.0.3"}, "RULE-CVE-2025-3858-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3858-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3860-01": {"ajax_action": "sc_ajax_handler", "conditions": [{"name": "ARGS:saleclass", "type": "exists"}, {"name": "ARGS:saleclass", "type": "regex", "value": "~[<>\\"\']~"}], "cve": "CVE-2025-3860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3860", "description": "CarDealerPress <=6.8.2505.00 Stored XSS via saleclass parameter in sc_ajax_handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cardealerpress", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.8.2505.00"}, "RULE-CVE-2025-3861-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/un-protect-files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API un-protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API file protection status endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/private-urls/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API private URLs endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3862-01": {"action": "init", "conditions": [{"name": "ARGS:cg_off_id", "type": "regex", "value": "~[<>\\"\'();]~"}], "cve": "CVE-2025-3862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3862", "description": "Contest Gallery <= 26.0.6 Stored XSS via cg_off_id parameter in shortcode rendering", "mode": "block", "severity": 5.4, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=26.0.6"}, "RULE-CVE-2025-3868-01": {"action": "admin_init", "conditions": [{"name": "ARGS:menuObject", "type": "detectXSS"}], "cve": "CVE-2025-3868", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3868", "description": "Custom Admin-Bar Favorites <=0.1 reflected XSS via menuObject parameter", "mode": "block", "severity": 6.1, "slug": "admin-bookmarks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-3876-01": {"action": "init", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "smsalert_ajax_form_validate"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3876", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sms-alert", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2025-3878-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[sa_verify\\\\s[^\\\\]]*(?:phone_selector|submit_selector|user_selector|pwd_selector|placeholder)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*\\\\)|<script|javascript:|on(?:error|load|click|mouseover)\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-3878", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3878", "description": "SMS Alert Order Notifications <= 3.8.1 Stored XSS via sa_verify shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "sms-alert", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2025-3888-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/async-upload.php"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg(?:\\\\?|#|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3888", "description": "Jupiter X Core <=4.8.12 Stored XSS via SVG File inclusion (block non-admin SVG uploads to async-upload.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "jupiterx-core", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=4.8.12"}, "RULE-CVE-2025-3888-02": {"ajax_action": "enable_unfiltered_files_upload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3888", "description": "Jupiter X Core <=4.8.12 missing authorization on enable_unfiltered_files_upload AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "jupiterx-core", "tags": ["missing-authorization", "xss", "svg-upload", "ajax"], "target": "plugin", "versions": "<=4.8.12"}, "RULE-CVE-2025-3889-01": {"action": "init", "conditions": [{"name": "ARGS:cquantity", "type": "exists"}, {"name": "ARGS:quantity", "type": "regex", "value": "~^ *-~"}], "cve": "CVE-2025-3889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3889", "description": "WP Simple Shopping Cart <=5.1.3 IDOR via negative quantity in cart update", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["idor", "business-logic", "unauthenticated"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-3890-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wp_cart_button|wpsc_add_to_cart_button)\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-3890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3890", "description": "WordPress Simple PayPal Shopping Cart <=5.1.3 Stored XSS via wp_cart_button shortcode in Classic Editor post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-3890-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wp_cart_button|wpsc_add_to_cart_button)\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-3890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3890", "description": "WordPress Simple PayPal Shopping Cart <=5.1.3 Stored XSS via wp_cart_button shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-3914-01": {"ajax_action": "aeropageMediaDownload", "conditions": [{"name": "ARGS:media", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)|(?:\\\\.?user\\\\.ini|\\\\.htaccess|\\\\.htpasswd)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-3914", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3914", "description": "Aeropage Sync for Airtable <=3.2.0 authenticated (Subscriber+) arbitrary file upload via aeropageMediaDownload AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "aeropage-sync-for-airtable", "tags": ["arbitrary-file-upload", "missing-file-type-validation", "authenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-3917-01": {"action": "init", "conditions": [{"name": "ARGS:img", "type": "regex", "value": "~https?://[^\\\\s]+\\\\.(?:ph(?:p\\\\d?|tml?|t|ar|s)|cgi|asp|aspx|jsp|jspx|cfm)(?:\\\\.[a-z]{2,4})?(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-3917", "method": "POST", "mode": "block", "severity": 9.8, "slug": "baiduseo", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-3917-02": {"action": "init", "conditions": [{"name": "ARGS:img1", "type": "regex", "value": "~https?://[^\\\\s]+\\\\.(?:ph(?:p\\\\d?|tml?|t|ar|s)|cgi|asp|aspx|jsp|jspx|cfm)(?:\\\\.[a-z]{2,4})?(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-3917", "method": "POST", "mode": "block", "severity": 9.8, "slug": "baiduseo", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-3919-01": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_user", "type": "regex", "value": "~(?:<[a-z]|\\\\x3c[a-z]|\\"|%22|&#(?:x22|34);?)(?:[^>]*\\\\bon[a-z]{3,}\\\\s*=|\\\\bstyle\\\\s*=|\\\\bautofocus|\\\\bjavascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_user parameter (wp_unslash only, no sanitize_text_field)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-02": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_password", "type": "regex", "value": "~(?:<[a-z]|\\\\x3c[a-z]|\\"|%22|&#(?:x22|34);?)(?:[^>]*\\\\bon[a-z]{3,}\\\\s*=|\\\\bstyle\\\\s*=|\\\\bautofocus|\\\\bjavascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_password parameter (wp_unslash only, no sanitize_text_field)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-03": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_server", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_server attribute breakout (sanitize_text_field strips tags but not quotes)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-04": {"action": "admin_init", "conditions": [{"name": "ARGS:ftp_server_path", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via ftp_server_path attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-05": {"action": "admin_init", "conditions": [{"name": "ARGS:export_ftp_path", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via export_ftp_path attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3919-06": {"action": "admin_init", "conditions": [{"name": "ARGS:export_ftp_file_name", "type": "regex", "value": "~(?:\\"|%22|&#(?:x22|34);?)\\\\s*(?:on[a-z]{3,}\\\\s*=|style\\\\s*=|autofocus|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3919", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3919", "description": "Comments Import & Export <=2.4.3 stored XSS via export_ftp_file_name attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "comments-import-export-woocommerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.3"}, "RULE-CVE-2025-3921-01": {"ajax_action": "pepro_reglogin", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~i"}], "cve": "CVE-2025-3921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3921", "description": "PeproDev Ultimate Profile Solutions <=7.5.2 unauthenticated arbitrary user meta update via pepro_reglogin AJAX handler", "method": "POST", "mode": "block", "severity": 8.2, "slug": "peprodev-ups", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=7.5.2"}, "RULE-CVE-2025-39458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39458", "description": "foton theme <= 2.5.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "foton", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2025-39458-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39458", "description": "foton theme <= 2.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "foton", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2025-39466-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39466", "description": "dor theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dor", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-39466-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39466", "description": "dor theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-39490-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39490", "description": "backpacktraveler theme <= 2.10.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "backpacktraveler", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.10.2"}, "RULE-CVE-2025-39490-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39490", "description": "backpacktraveler theme <= 2.10.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "backpacktraveler", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.10.2"}, "RULE-CVE-2025-3952-01": {"ajax_action": "pto_remove_logo", "conditions": [{"name": "ARGS:type", "type": "exists"}, {"type": "missing_capability", "value": "edit_cqpim_settings"}], "cve": "CVE-2025-3952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3952", "description": "Projectopia <=5.1.16 missing authorization on pto_remove_logo AJAX handler allows authenticated users (Subscriber+) to clear arbitrary WordPress options via the type parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "projectopia-core", "tags": ["missing-authorization", "broken-access-control", "arbitrary-option-update"], "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2025-3953-01": {"ajax_action": "wp_statistics_option_updater", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3953", "description": "WP Statistics <=14.13.3 missing authorization on wp_statistics_option_updater AJAX handler allows authenticated users to update arbitrary plugin settings", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=14.13.3"}, "RULE-CVE-2025-39550-01": {"ajax_action": "fcom_user_registration", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39550", "description": "FluentCommunity <=1.2.15 unauthenticated PHP object injection via fcom_user_registration AJAX handler", "mode": "block", "severity": 9.8, "slug": "fluent-community", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.2.15"}, "RULE-CVE-2025-39550-02": {"ajax_action": "fcom_user_login_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39550", "description": "FluentCommunity <=1.2.15 unauthenticated PHP object injection via fcom_user_login_form AJAX handler", "mode": "block", "severity": 9.8, "slug": "fluent-community", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.2.15"}, "RULE-CVE-2025-39551-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluent-boards/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39551", "description": "FluentBoards <=1.47 unauthenticated PHP object injection via REST API deserialization", "mode": "block", "severity": 9.8, "slug": "fluent-boards", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-39557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kadence-woomail-import", "type": "exists"}, {"name": "FILES:kadence-woomail-import-file:name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml?|phar|shtml|cgi)(?:\\\\.|$)~i"}, {"name": "REQUEST_URI", "type": "contains", "value": "customize.php"}], "cve": "CVE-2025-39557", "description": "Blocks unrestricted file upload (CWE-434) in Kadence WooCommerce Email Designer import feature. Detects non-JSON file uploads to the customizer import endpoint by inspecting the uploaded filename for dangerous extensions (PHP, PHTML, PHAR, etc.).", "mode": "block", "severity": 9.1, "slug": "kadence-woocommerce-email-designer", "target": "plugin", "versions": "<1.5.15"}, "RULE-CVE-2025-39590-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+~"}, {"name": "ARGS:data[settings][tab_title]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-39590", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39590", "description": "Essential Addons for Elementor <=6.1.9 contributor+ stored XSS via Advanced Tabs tab_title widget setting", "mode": "block", "severity": 6.5, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.9"}, "RULE-CVE-2025-39596-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (GET)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-39596-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (POST)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-4054-02": {"action": "init", "conditions": [{"name": "ARGS:highlight", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<body[^>]+onload\\\\s*=|<details[^>]+ontoggle\\\\s*=|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=)~i"}], "cve": "CVE-2025-4054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4054", "description": "Relevanssi <=4.24.3 unauthenticated reflected XSS via highlight query parameter", "mode": "block", "severity": 6.1, "slug": "relevanssi", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.24.3"}, "RULE-CVE-2025-4099-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<iframe|<img\\\\b[^>]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4099-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<iframe|<img\\\\b[^>]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in post_content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4104-01": {"ajax_action": "fed_login_form_post", "conditions": [{"name": "ARGS:submit", "type": "equals", "value": "register"}, {"name": "ARGS:ID", "type": "exists"}], "cve": "CVE-2025-4104", "method": "POST", "mode": "block", "severity": 9.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.6"}, "RULE-CVE-2025-4127-01": {"ajax_action": "kcSeoMainSettings_action", "conditions": [{"name": "ARGS:site_price_range", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4127", "description": "WP SEO Structured Data Schema <=2.7.11 Stored XSS via site_price_range parameter in kcSeoMainSettings_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-seo-structured-data-schema", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-4131-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode attributes in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode event handler in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4133-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_title", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 stored XSS via unescaped post title in plugin dashboard views", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-ship"}, {"name": "ARGS:postId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via postId parameter on ship page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByDate", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByDate on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sUserAuthId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sUserAuthId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sPostBlogId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sPostBlogId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByNetwork", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByNetwork on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4169-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ppc\\\\b[^\\\\]]*(?:moretxt|title)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=)(?:(?!\\\\1).)*\\\\1~i"}], "cve": "CVE-2025-4169", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4169", "description": "Posts per Cat <=1.4.2 authenticated (Contributor+) stored XSS via [ppc] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "posts-per-cat", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-4169-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ppc\\\\b[^\\\\]]*(?:moretxt|title)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=)(?:(?!\\\\1).)*\\\\1~i"}], "cve": "CVE-2025-4169", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4169", "description": "Posts per Cat <=1.4.2 authenticated (Contributor+) stored XSS via [ppc] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "posts-per-cat", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-4171-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wfp\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4171", "description": "WZ Followed Posts <= 3.1.0 Stored XSS via [wfp] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "where-did-they-go-from-here", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-4171-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wfp\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4171", "description": "WZ Followed Posts <= 3.1.0 Stored XSS via [wfp] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "where-did-they-go-from-here", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-4188-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "abundatrade"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|svg|img|object|embed|form|details|math)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=abundatrade)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4188-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "reorder-simple-image-text-slider-setting"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|svg|img|object|embed|form|details|math)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=reorder-simple-image-text-slider-setting)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4203-01": {"action": "init", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-02": {"action": "init", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-03": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-04": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-05": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-06": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4206-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "import_delete"}, {"name": "ARGS:import", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_import_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4206-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "export_delete"}, {"name": "ARGS:export", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_export_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4208-01": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS:header_params", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in flat header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4208-02": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in array-encoded header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4212-01": {"ajax_action": "alg_ajax_file_upload", "conditions": [{"name": "ARGS:alg_checkout_files_upload_uploader", "type": "exists"}], "cve": "CVE-2025-4212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4212", "description": "Checkout Files Upload for WooCommerce <=2.2.1 unauthenticated stored XSS via uploaded filename in alg_ajax_file_upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "checkout-files-upload-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-4223-01": {"ajax_action": "pagelayer_login_submit", "conditions": [{"name": "ARGS:login_url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|unload|mouseover|mouseout|mousedown|mouseup|mousemove|click|dblclick|focus|blur|change|submit|reset|select|keydown|keyup|keypress|input|beforeunload|resize|scroll|contextmenu|drag|drop|copy|cut|paste|abort|cancel|invalid|toggle|wheel|pointerdown|pointerup|pointermove|pointerover|pointerout|pointercancel)\\\\s*=|javascript\\\\s*:|data:[a-zA-Z+][a-zA-Z0-9+./-]*(?:;[^,]*)?,|vbscript\\\\s*:|%3Cscript|%253Cscript|javascript%3A|%6A%61%76%61%73%63%72%69%70%74)~i"}], "cve": "CVE-2025-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4223", "description": "Pagelayer <=2.0.0 reflected XSS via login_url parameter in pagelayer_login_submit AJAX handler", "mode": "block", "severity": 4.7, "slug": "pagelayer", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-4315-01": {"ajax_action": "cwp_user_data", "conditions": [{"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(?:capabilities|user_level)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via arbitrary user meta update on cwp_user_data AJAX action (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_capabilities", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_user_level", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4334-01": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^wpr\\\\[[^\\\\]]*\\\\]\\\\[(?:[a-z0-9_]*_)?capabilities\\\\]|^wpr\\\\[[^\\\\]]*\\\\]\\\\[wp_user_level\\\\]~i"}], "cve": "CVE-2025-4334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4334", "description": "Simple User Registration <=6.3 unauthenticated privilege escalation via arbitrary wp_capabilities meta injection in wpr_submit_form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.3"}, "RULE-CVE-2025-4367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wpdm_user_dashboard"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_user_dashboard\\\\b[^\\\\]]*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4367", "description": "Download Manager <=3.3.18 Authenticated (Author+) Stored XSS via wpdm_user_dashboard shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "download-manager", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.3.18"}, "RULE-CVE-2025-4369-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "companion-auto-update"}, {"name": "ARGS:update_delay_days", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4369", "description": "Companion Auto Update <=3.9.2 Stored XSS via update_delay_days parameter on settings page", "method": "POST", "mode": "block", "severity": 5.5, "slug": "companion-auto-update", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2025-4369-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "companion-auto-update"}, {"name": "ARGS:cau_email", "type": "detectXSS"}], "cve": "CVE-2025-4369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4369", "description": "Companion Auto Update <=3.9.2 Stored XSS via cau_email parameter on settings page", "method": "POST", "mode": "block", "severity": 5.5, "slug": "companion-auto-update", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2025-4396-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "exists"}, {"name": "ARGS:cats", "type": "detectSQLi"}], "cve": "CVE-2025-4396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4396", "description": "Relevanssi <= 4.24.4 unauthenticated SQL injection via cats search parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "relevanssi", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.24.4"}, "RULE-CVE-2025-4396-02": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "exists"}, {"name": "ARGS:tags", "type": "detectSQLi"}], "cve": "CVE-2025-4396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4396", "description": "Relevanssi <= 4.24.4 unauthenticated SQL injection via tags search parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "relevanssi", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.24.4"}, "RULE-CVE-2025-4403-01": {"ajax_action": "dnd_codedropz_upload_wc", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~(?:^|\\\\|)[^a-zA-Z0-9_|\']*(?:ph(?:p\\\\d?|ps|t(?:ml)?|ar)|shtml|cgi|asp|aspx|jsp|jspx|cfm)(?:\\\\||$)~i"}], "cve": "CVE-2025-4403", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-4405-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[randomimage\\\\b[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:|data\\\\s*:|<script|(?:^|[\\\\s<])on[a-z0-9_:-]+\\\\s*=)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4405", "description": "Hot Random Image <=1.9.2 Stored XSS via link attribute in randomimage shortcode (classic editor post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "hot-random-image", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-4405-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~hot-random-image[^>]*[\\"\']link[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:|data\\\\s*:|<script|(?:^|[\\\\s<])on[a-z0-9_:-]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4405", "description": "Hot Random Image <=1.9.2 Stored XSS via link attribute in Gutenberg block (REST API post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "hot-random-image", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-4429-01": {"ajax_action": "gearside_search_theme_files", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|blur|submit|change|input|keydown|keyup|keypress) *=|<script[ />]|javascript *:)~i"}], "cve": "CVE-2025-4429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4429", "description": "Gearside Developer Dashboard <=1.0.72 unauthenticated reflected XSS via data parameter in gearside_search_theme_files AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "gearside-developer-dashboard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.72"}, "RULE-CVE-2025-4473-01": {"ajax_action": "fed_ajax_request", "conditions": [{"name": "ARGS:fed_action_hook", "type": "regex", "value": "~^FEDEmail@(update|update_smtp)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4473", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": ">=1.5.10 <=2.2.7"}, "RULE-CVE-2025-4474-01": {"ajax_action": "fed_admin_setting_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4474", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-4479-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:before_label|after_label)[^:]*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*?(?:<\\\\s*(?:script|iframe|svg|object|embed|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keyup|keydown|keypress|animationend|toggle)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4479", "description": "ElementsKit Lite <=3.5.2 Stored XSS via Image Comparison widget before/after labels through Elementor editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4523-01": {"ajax_action": "admin_donor_profile_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4523", "description": "IDonate <=2.1.9 missing authorization on admin_donor_profile_view AJAX handler exposes sensitive user data", "mode": "block", "severity": 6.5, "slug": "idonate", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-4579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-content-security-policy/v1/report(/|\\\\?|&|$)~"}, {"name": "ARGS:csp-report", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|body|video|audio|form|base|style|meta|details|math)[\\\\s/>]|on(?:load|error|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4579", "description": "WP Content Security Plugin <=2.3 unauthenticated Stored XSS via blocked-uri and effective-directive in CSP report REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-content-security-policy", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-4593-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/[0-9]+)?/?(?:[?#]|$)|/(?:index\\\\.php)?\\\\?(?:[^#&]*&)*rest_route=/wp/v2/posts(?:/[0-9]+)?/?(?:[&#]|$))~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in REST post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4594-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (post editor vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4594-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (REST API vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4597-01": {"ajax_action": "woo_slide_pro_delete_draft_preview", "conditions": [{"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-4597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4597", "description": "Woo Slider Pro <=1.12 missing authorization on woo_slide_pro_delete_draft_preview AJAX action allows Subscriber+ arbitrary post deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woo-slider-pro-drag-drop-slider-builder-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-deletion"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-4602-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file filename path traversal", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4602-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:entity_type", "type": "regex", "value": "~^(?:\\\\.|\\\\.\\\\.)$|(?:\\\\.\\\\.[/\\\\\\\\])~"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file entity_type directory escape", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\b[^\\\\]]*(?:<script|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror|<svg[^>]*on|<iframe|<object|<embed)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4608", "description": "Structured Content <=1.6.4 Stored XSS via sc_fs_local_business shortcode attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2025-4608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\b[^\\\\]]*(?:<script|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror|<svg[^>]*on|<iframe|<object|<embed)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4608", "description": "Structured Content <=1.6.4 Stored XSS via sc_fs_local_business shortcode attributes in REST API post create/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2025-4610-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmem_user_memberships\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|details|embed|object|video|audio|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|focusin|pointerover)\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-4610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4610", "description": "WP-Members <=3.5.2 Stored XSS via [wpmem_user_memberships] shortcode attributes in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4610-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmem_user_memberships\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|details|embed|object|video|audio|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|focusin|pointerover)\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-4610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4610", "description": "WP-Members <=3.5.2 Stored XSS via [wpmem_user_memberships] shortcode attributes in REST API post creation/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4611-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-4611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-46244-01": {"ajax_action": "dsalv_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-02": {"ajax_action": "dsalv_add_new_variation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-03": {"ajax_action": "dsalv_searchalltags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46254-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:vcv-settings", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-46254", "description": "Visual Composer Website Builder <=45.10.0 contributor+ stored XSS via vcv-settings element attributes", "method": "POST", "mode": "block", "severity": 6.5, "slug": "visualcomposer", "target": "plugin", "versions": "<=45.10.0"}, "RULE-CVE-2025-46490-01": {"ajax_action": "ccpuz_save_crossword_mce_from", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-46490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-46490", "description": "Crossword Compiler Puzzles <=5.2 subscriber+ arbitrary file upload via ccpuz_save_crossword_mce_from AJAX handler", "mode": "block", "severity": 9.9, "slug": "crossword-compiler-puzzles", "tags": ["arbitrary-file-upload", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=5.2"}, "RULE-CVE-2025-4652-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~broadstreet/Broadstreet/Vendor/broadstreet-partner/index\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:next", "type": "detectXSS"}], "cve": "CVE-2025-4652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4652", "description": "Broadstreet <= 1.51.7 Reflected XSS via unsanitized next parameter in broadstreet-partner index.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "broadstreet", "tags": ["xss", "reflected-xss", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.51.7"}, "RULE-CVE-2025-4665-01": {"action": "admin_notices", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:fid", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4665", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4665", "description": "Contact Form CFDB7 <=1.3.2 authenticated SQL injection and reflected XSS via unsanitized fid parameter in cfdb7_admin_notice (admin_notices hook)", "method": "GET", "mode": "block", "severity": 9.6, "slug": "contact-form-cfdb7", "tags": ["sql-injection", "xss", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-4665-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:|%3[Cc]script)~i"}], "cve": "CVE-2025-4665", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4665", "description": "Contact Form CFDB7 <=1.3.2 authenticated reflected XSS via unsanitized REQUEST_URI echoed in CFDB7_List_Table::bulk_actions (admin_init lifecycle fallback)", "method": "GET", "mode": "block", "severity": 9.6, "slug": "contact-form-cfdb7", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-4666-01": {"ajax_action": "zpAccountsViaAJAX", "conditions": [{"name": "ARGS:nickname", "type": "detectXSS"}], "cve": "CVE-2025-4666", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4666", "description": "Zotpress <=7.3.15 Stored XSS via nickname parameter in zpAccountsViaAJAX AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "zotpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.3.15"}, "RULE-CVE-2025-4667-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in post_content (post.php vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in content (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4669-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[wpbc\\\\b[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<script)~i"}], "cve": "CVE-2025-4669", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4669", "description": "WP Booking Calendar <=10.11.1 Stored XSS via wpbc shortcode attributes in post content (post.php injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=10.11.1"}, "RULE-CVE-2025-4670-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4671-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode operator attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*pre\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode pre attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*post\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode post attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*(?:pre|post)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4672-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta GET endpoint reading sensitive user meta (wp_capabilities, session_tokens)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta POST endpoint creating sensitive user meta (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta PUT endpoint updating sensitive user meta (wp_capabilities)", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta DELETE endpoint removing sensitive user meta (wp_capabilities)", "method": "DELETE", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4685-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|applet)\\\\b~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via dangerous tag injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4691-01": {"ajax_action": "view_request_details", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-02": {"ajax_action": "view_request_details_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_car booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-03": {"ajax_action": "view_request_details_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_restau booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-04": {"ajax_action": "view_hotel_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_hotel_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-05": {"ajax_action": "view_car_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_car_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-06": {"ajax_action": "view_restau_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_restau_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-07": {"ajax_action": "approve_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-08": {"ajax_action": "decline_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-09": {"ajax_action": "approve_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-10": {"ajax_action": "decline_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-11": {"ajax_action": "approve_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-12": {"ajax_action": "decline_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-47452-01": {"ajax_action": "wpvr_file_import", "conditions": [{"name": "FILES:wpvr_import_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47452", "description": "WP VR <=8.5.26 authenticated arbitrary file upload via wpvr_file_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "wpvr", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=8.5.26"}, "RULE-CVE-2025-47461-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:sfwc_nonce_frontend_edit_subaccount_form", "type": "exists"}, {"name": "ARGS:user", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47461-02": {"ajax_action": "sfwc_frontend_edit_subaccount", "conditions": [{"name": "ARGS:ajax_user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47549-01": {"ajax_action": "beaf_options_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 authenticated arbitrary file upload via beaf_options_save AJAX handler (missing authorization)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47549-02": {"ajax_action": "beaf_options_save", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 arbitrary PHP file upload via beaf_options_save AJAX handler (dangerous file type)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47588-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules(?:/|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API POST /awdp/v1/rules/ in aco-woo-dynamic-pricing <= 4.5.9. Prevents PHP callable names from being stored as rule data that later reaches call_user_func sinks.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47588-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules/\\\\d+(?:/|$|\\\\?)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API PUT /awdp/v1/rules/{id} in aco-woo-dynamic-pricing <= 4.5.9. Covers the update path for the same stored-callback code injection vector.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47601-01": {"ajax_action": "maxi_get_option", "conditions": [{"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47601", "method": "POST", "mode": "block", "severity": 8.8, "slug": "maxi-blocks", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-47636-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (classic editor)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47636-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (block editor / REST API)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47637-01": {"ajax_action": "staggs_get_configuration_form_urls", "conditions": [{"name": "ARGS:contents", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|<%(?:\\\\s|=)|<script[\\\\s/>]~i"}], "cve": "CVE-2025-47637", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47637", "description": "STAGGS <=2.11.0 unauthenticated arbitrary file upload via contents parameter in staggs_get_configuration_form_urls AJAX handler", "mode": "block", "severity": 10.0, "slug": "staggs", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "cwe-434"], "target": "plugin", "versions": "<=2.11.0"}, "RULE-CVE-2025-47688-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/hide-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47688-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/minimize-maximize-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47690-01": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-02": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-05": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-06": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-4774-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~premium-countdown.*?(?:<script[\\\\s/>]|<svg[\\\\s/]|<img[\\\\s/]|<iframe[\\\\s/]|on(?:load|error|mouseover|click|focus|mouseout|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4774", "description": "Premium Addons for Elementor <=4.11.8 Stored XSS via Countdown widget data-countdown attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "premium-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=4.11.8"}, "RULE-CVE-2025-4783-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:elements", "type": "regex", "value": "~exad.?countdown~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:(?:<|\\\\\\\\u003[cC]|\\\\\\\\x3[cC])\\\\s*(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|isindex|form|button|textarea|select|base|link|style|applet)|\\\\bon(?:mouse(?:over|out|enter|move|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|drag|drop|pointer|touch|animate|transition|toggle|resize|scroll|wheel|(?:before)?input|play|seek|ended|abort|invalid|select|cut|copy|paste|contextmenu|reset|unload|beforeunload|pageshow|popstate|hashchange|message|storage|online|offline|(?:before)?print|readystatechange|DOMContentLoaded)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4783", "description": "Exclusive Addons for Elementor <=2.7.9.1 Stored XSS via Countdown Timer widget settings in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=2.7.9.1"}, "RULE-CVE-2025-4783-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~exad.?countdown~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:(?:<|\\\\\\\\u003[cC]|\\\\\\\\x3[cC])\\\\s*(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|isindex|form|button|textarea|select|base|link|style|applet)|\\\\bon(?:mouse(?:over|out|enter|move|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|drag|drop|pointer|touch|animate|transition|toggle|resize|scroll|wheel|(?:before)?input|play|seek|ended|abort|invalid|select|cut|copy|paste|contextmenu|reset|unload|beforeunload|pageshow|popstate|hashchange|message|storage|online|offline|(?:before)?print|readystatechange|DOMContentLoaded)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4783", "description": "Exclusive Addons for Elementor <=2.7.9.1 Stored XSS via Countdown Timer widget settings in Elementor REST API save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.9.1"}, "RULE-CVE-2025-4799-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "download-manager.php"}, {"name": "ARGS:file_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:)~"}], "cve": "CVE-2025-4799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799", "description": "WP-DownloadManager <=1.68.10 authenticated (Administrator+) arbitrary file deletion via absolute path traversal in file_name parameter on download-manager.php admin page", "mode": "block", "severity": 7.2, "slug": "wp-downloadmanager", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.68.10"}, "RULE-CVE-2025-4799-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "download-options.php"}, {"name": "ARGS:download_path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^(?!/var/www/html/wp-content|/home/[^/]+/[^/]+/wp-content)[/])~"}], "cve": "CVE-2025-4799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799", "description": "WP-DownloadManager <=1.68.10 authenticated (Administrator+) download_path manipulation enabling arbitrary file deletion chain on download-options.php admin page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-downloadmanager", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.68.10"}, "RULE-CVE-2025-4803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:posttypes", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-4803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4803", "description": "Glossary by WPPedia <=1.3.0 authenticated (Administrator+) PHP Object Injection via posttypes parameter deserialization", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wppedia", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-48101-01": {"ajax_action": "ctct_form_designer", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via ctct_form_designer AJAX handler", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48101-02": {"ajax_action": "ctct_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via ctct_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48101-03": {"action": "template_redirect", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via template_redirect form processing", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48140-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_change\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_change shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:wp-admin/(?:post\\\\.php|post-new\\\\.php)|wp-json/|xmlrpc\\\\.php)~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_carat\\\\s[^\\\\]]*\\\\bbase\\\\s*=\\\\s*(?:(?!\\\\s+[A-Za-z_][\\\\w-]*\\\\s*=)[^\\\\]])*?(?:[;`$(){}|<>]|\\\\b(?:phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|create_function|call_user_func|base64_decode|preg_replace)\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_carat shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48142-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-03": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-04": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48165-01": {"ajax_action": "openai_api_request", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48165", "description": "DELUCKS SEO <=2.6.0 privilege escalation via openai_api_request AJAX action missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delucks-seo", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-48165-02": {"ajax_action": "save_selected_open_ai_prompt_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48165", "description": "DELUCKS SEO <=2.6.0 privilege escalation via save_selected_open_ai_prompt_option AJAX action missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delucks-seo", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-49076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:theplus_clients_url", "type": "exists"}, {"name": "ARGS:theplus_clients_url", "type": "regex", "value": "~^\\\\s*(javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-49076", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.2.7"}, "RULE-CVE-2025-49235-01": {"ajax_action": "get_installed_template", "conditions": [{"name": "ARGS:template_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via template_id in get_installed_template AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49235-02": {"ajax_action": "template_category", "conditions": [{"name": "ARGS:category", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via category in template_category AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49244-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - Reflected XSS via su_generator_preview AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49244-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - XSS/Code Execution via su_generator_settings AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49359-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49359-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49360-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49360-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49408-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/templately/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49408", "description": "Templately <=3.2.7 sensitive data exposure via unauthenticated access to REST API settings endpoint", "mode": "block", "severity": 10.0, "slug": "templately", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-4943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in Elementor REST document save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in wp-admin post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in elementor_ajax save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4944-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|img|svg|iframe|details|embed|object|video|audio|body|marquee|isindex|form|button|textarea|select|math|meta|link|style|base|source|input)[\\\\s/][^>]*(?:on(?:error|load|click|mouseover|focus|blur|toggle|mouseenter|mouseleave|change|submit|keydown|keyup|keypress|resize|scroll|animat(?:ion(?:end|start|iteration)|ionend)|transition(?:end|run|start))\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript:)|<script[\\\\s>]|[\\"\']\\\\s*javascript\\\\s*:[^\\\\s]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4944", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored XSS via Image Compare widget settings in Elementor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4944-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|img|svg|iframe|details|embed|object|video|audio|body|marquee|isindex|form|button|textarea|select|math|meta|link|style|base|source|input)[\\\\s/][^>]*(?:on(?:error|load|click|mouseover|focus|blur|toggle|mouseenter|mouseleave|change|submit|keydown|keyup|keypress|resize|scroll|animat(?:ion(?:end|start|iteration)|ionend)|transition(?:end|run|start))\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript:)|<script[\\\\s>]|[\\"\']\\\\s*javascript\\\\s*:[^\\\\s]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4944", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored XSS via Google Maps widget settings in Elementor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-49924-01": {"ajax_action": "wwpEditWholesaleRole", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49924", "description": "Wholesale Suite \\u2013 WooCommerce Wholesale Prices <=2.2.4.2 privilege escalation via wwpEditWholesaleRole AJAX action", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woocommerce-wholesale-prices", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.4.2"}, "RULE-CVE-2025-49941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49950-01": {"ajax_action": "wc_billingo_generate_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_generate_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49950-02": {"ajax_action": "wc_billingo_storno_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_storno_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_key", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_key)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-49960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_secret", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_secret)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-50003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-50003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-5018-01": {"ajax_action": "hs_update_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_update_ai_chat_settings AJAX handler allows authenticated users to overwrite AI chat configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-02": {"ajax_action": "hive_lite_support_get_all_binbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hive_lite_support_get_all_binbox AJAX handler allows authenticated users to read sensitive inbox configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-03": {"ajax_action": "hs_get_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_get_ai_chat_settings AJAX handler allows authenticated users to read OpenAI API key and AI configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5035-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5035-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus", "rest-api"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5058-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_image"}, {"name": "ARGS:image_id", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5058-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5071-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/messages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5071-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/sse(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "GET", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~attachmentEditIframe\\\\.php~"}, {"name": "ARGS:attachment_id", "type": "detectXSS"}], "cve": "CVE-2025-5082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5082", "description": "WP Attachments <=5.0.12 reflected XSS via attachment_id parameter in attachmentEditIframe.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-attachments", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.12"}, "RULE-CVE-2025-5083-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_options"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via plugin settings (wpgov_at_options) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5083-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_option_groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via group configuration (wpgov_at_option_groups) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5084-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[read_more_text]", "type": "regex", "value": "~<[^>]*[\\\\s/]on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|svg|math|base|link|meta|style|form|input|select|textarea|details|body|marquee)\\\\b|javascript\\\\s*:~i"}], "cve": "CVE-2025-5084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5084", "description": "Post Grid Master <=3.4.13 reflected XSS via argsArray[read_more_text] in asr_filter_posts AJAX handler", "mode": "block", "severity": 6.1, "slug": "ajax-filter-posts", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.4.13"}, "RULE-CVE-2025-5096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_caption]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_caption table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_title]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_title table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_footer]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_footer table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_content_padding]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_content_padding table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5116-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_html(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_html REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_query(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_query REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_data REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-04": {"ajax_action": "async_wppic_shortcode_content", "conditions": [{"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 stored XSS via containerid parameter in async shortcode AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5117-01": {"action": "init", "conditions": [{"name": "ARGS:iv-submit-listing", "type": "equals", "value": "register"}, {"name": "ARGS:payment_gateway", "type": "equals", "value": "paypal"}, {"name": "ARGS:package_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5117-02": {"action": "init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "iv_payment"}, {"name": "ARGS:property_package_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|admin)(?:\\\\s|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5122-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts/\\\\d+(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5144-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "tribe_events"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-(?:date[a-z-]*|provide)\\\\s*=[^>]*(?:<\\\\s*script|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5144", "description": "The Events Calendar <=6.13.2 Stored XSS via data-date-* attributes in event post content (wp-admin post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-events-calendar", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=6.13.2"}, "RULE-CVE-2025-5234-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post create/update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post update (PUT)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in classic editor post.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5237-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[brid[^\\\\]]*(?:width|height)\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|&#x?0*3c;|&#x?0*3e;|&#x?0*22;|&#x?0*27;|&#0*60;|&#0*62;|&#0*34;|&#0*39;)~i"}], "cve": "CVE-2025-5237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5237", "description": "Target Video Easy Publish <=3.8.5 Stored XSS via shortcode width/height attribute breakout in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brid-video-easy-publish", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.8.5"}, "RULE-CVE-2025-5237-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[brid[^\\\\]]*(?:width|height)\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|&#x?0*3c;|&#x?0*3e;|&#x?0*22;|&#x?0*27;|&#0*60;|&#0*62;|&#0*34;|&#0*39;)~i"}], "cve": "CVE-2025-5237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5237", "description": "Target Video Easy Publish <=3.8.5 Stored XSS via shortcode attribute breakout through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brid-video-easy-publish", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.8.5"}, "RULE-CVE-2025-5239-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "dfs_template"}, {"name": "ARGS:post_content", "type": "regex", "value": "~domain-for-sale-template[^}]*className[\\"\']?\\\\s*[:=]\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5239", "description": "Domain For Sale <=3.0.10 Authenticated (Contributor+) Stored XSS via class_name parameter in Gutenberg block post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "domain-for-sale", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2025-5240-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCita(?:MeetingScheduler|ContactForm)[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaMeetingScheduler/vCitaContactForm", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5240-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCitaSchedulingCalendar[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaSchedulingCalendar", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5258-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:\\\\[conf_scheduler[^\\\\]]*className\\\\s*=\\\\s*[\\"\'][^\\"\']*|conf-scheduler/display[^}]*className[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*)(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<[a-z/])~i"}], "cve": "CVE-2025-5258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5258", "description": "Conference Scheduler <=2.5.1 Stored XSS via className attribute in shortcode/block (classic editor vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "conference-scheduler", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-5259-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:minimal-share-buttons|msb_share)[^>\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:<script|on[a-z]{2,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5259", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5259", "description": "Minimal Share Buttons <=1.7.3 Stored XSS via unescaped align block attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "minimal-share-buttons", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-5259-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:minimal-share-buttons|msb_share)[^>\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:<script|on[a-z]{2,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5259", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5259", "description": "Minimal Share Buttons <=1.7.3 Stored XSS via unescaped align block attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "minimal-share-buttons", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-52745-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-52745", "description": "farmagrico theme <= 1.3.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "farmagrico", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-52745-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-52745", "description": "farmagrico theme <= 1.3.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "farmagrico", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-52758-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zippy"}, {"name": "FILES:zippy_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$|(?:^|[\\\\/])\\\\.htpasswd$~i"}], "cve": "CVE-2025-52758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52758", "description": "Zippy <=1.7.0 authenticated arbitrary file upload via admin page file handler", "mode": "block", "severity": 9.1, "slug": "zippy", "tags": ["arbitrary-file-upload", "authenticated"], "target": "plugin", "versions": "<=1.7.0"}, "RULE-CVE-2025-52768-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-52768", "description": "faith-hope theme <= 2.13.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "faith-hope", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.13.0"}, "RULE-CVE-2025-52768-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-52768", "description": "faith-hope theme <= 2.13.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "faith-hope", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.13.0"}, "RULE-CVE-2025-52815-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-52815", "description": "citygov theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "citygov", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-52815-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-52815", "description": "citygov theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "citygov", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-5282-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-travel-engine/v2/trips/\\\\d+/packages/\\\\d+~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-5282", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5282", "description": "WP Travel Engine <=6.5.1 unauthenticated arbitrary post deletion via REST API delete_package endpoint", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "wp-travel-engine", "tags": ["missing-authorization", "unauthenticated", "rest-api", "arbitrary-post-deletion"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-5282-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-travel-engine/v2/trips/\\\\d+/packages/\\\\d+~"}, {"name": "ARGS:_method", "type": "regex", "value": "~^DELETE$~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-5282", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5282", "description": "WP Travel Engine <=6.5.1 unauthenticated arbitrary post deletion via REST API delete_package with POST method override", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-travel-engine", "tags": ["missing-authorization", "unauthenticated", "rest-api", "arbitrary-post-deletion", "method-override"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-52824-01": {"ajax_action": "update_event_cost_from_package", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "update_event_cost_from_package"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-52824", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mobile-dj-manager", "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2025-52825-01": {"ajax_action": "wcp_rem_save_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wcp_rem_save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-52825", "method": "POST", "mode": "block", "severity": 8.8, "slug": "real-estate-manager", "target": "plugin", "versions": "<=7.3"}, "RULE-CVE-2025-52825-02": {"ajax_action": "wcp_rem_save_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wcp_rem_save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-52825", "method": "GET", "mode": "block", "severity": 8.8, "slug": "real-estate-manager", "target": "plugin", "versions": "<=7.3"}, "RULE-CVE-2025-5286-01": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5286", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5286", "description": "Bold Builder <=5.3.6 Stored XSS via additional_settings in bt_bb_content_slider shortcode (bt_bb_get_html AJAX)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-5286-02": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5286", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5286", "description": "Bold Builder <=5.3.6 Stored XSS via additional_settings in bt_bb_content_slider shortcode (bt_bb_fe_get_html AJAX)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-5286-03": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5286", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5286", "description": "Bold Builder <=5.3.6 Stored XSS via additional_settings in bt_bb_content_slider shortcode (bt_bb_fe_save AJAX)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-5290-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~borderless.elementor.(?:progress.bar|circular.progress.bar|semi.circular.progress.bar)~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\\\\\\\"|\\")widgetType(?:\\\\\\\\\\"|\\")\\\\s*:\\\\s*(?:\\\\\\\\\\"|\\")borderless\\\\.elementor\\\\.(?:progress\\\\.bar|circular\\\\.progress\\\\.bar|semi\\\\.circular\\\\.progress\\\\.bar)(?:\\\\\\\\\\"|\\")[\\\\s\\\\S]{0,2000}?(?:\\\\\\\\\\"|\\")title(?:\\\\\\\\\\"|\\")\\\\s*:\\\\s*(?:\\\\\\\\\\"|\\")[^\\\\\\\\\\"]*(?:<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=|<\\\\s*svg\\\\b[^>]*\\\\bonload\\\\s*=|<\\\\s*iframe\\\\b|\\\\bsrc\\\\s*=\\\\s*[\'\\\\\\"]?\\\\s*javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|change|submit|keydown|keyup|keypress|dblclick|contextmenu|wheel|pointerdown|animationend|toggle|resize)\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-5290", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5290", "description": "Borderless \\u2013 Elementor Addons and Templates <=1.7.1 Authenticated (Contributor+) Stored XSS via Elementor widget title settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "borderless", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5304-01": {"ajax_action": "wpnb_pto_new_users_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-02": {"ajax_action": "wpnb_pto_users_deletd", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-03": {"ajax_action": "wpnb_pto_new_email_system_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5314-01": {"action": "init", "conditions": [{"name": "ARGS:pdf-source", "type": "regex", "value": "~(?:<script[ />]|j[^a-z]*a[^a-z]*v[^a-z]*a[^a-z]*s[^a-z]*c[^a-z]*r[^a-z]*i[^a-z]*p[^a-z]*t[^a-z]*:|on(?:load|error|mouseover|click|focus|blur)[ ]*=|<(?:img|svg|iframe|embed|object)[ /][^>]*on[a-z]+=)~i"}], "cve": "CVE-2025-5314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5314", "description": "Dear Flipbook <=2.3.65 DOM-Based Reflected XSS via pdf-source query parameter", "mode": "block", "severity": 6.1, "slug": "3d-flipbook-dflip-lite", "tags": ["xss", "dom-based-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.65"}, "RULE-CVE-2025-53303-01": {"ajax_action": "import_content_xml", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_content_xml AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-02": {"ajax_action": "import_demo", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_demo AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-03": {"ajax_action": "import_widgets_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_widgets_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-04": {"ajax_action": "import_customizer_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_customizer_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-05": {"ajax_action": "import_page_options_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_page_options_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-06": {"ajax_action": "import_elementor_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_elementor_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-07": {"ajax_action": "import_menus_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_menus_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-08": {"ajax_action": "import_woocommerce_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_woocommerce_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-09": {"ajax_action": "import_ess_grid_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_ess_grid_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-10": {"ajax_action": "import_rev_sliders_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_rev_sliders_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-11": {"ajax_action": "import_instagram_feed_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_instagram_feed_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-12": {"ajax_action": "download_media_package", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 unauthorized access via download_media_package AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-5336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ht[_-]ctc[_-]chat\\\\b[^\\\\]]*\\\\bno_number\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|&#x?[0-9a-f]+;)~i"}], "cve": "CVE-2025-5336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5336", "description": "Click to Chat for WhatsApp <=4.22 Stored DOM-Based XSS via shortcode no_number attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.22"}, "RULE-CVE-2025-5337-01": {"ajax_action": "ms_save_slideshow", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=)|<(?:script|img|svg|iframe|object|embed|video|audio|source|link|meta|base|form|details)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5337", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5337", "description": "MetaSlider <=3.98.0 Stored DOM-Based XSS via aria-label parameter in ms_save_slideshow AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ml-slider", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.98.0"}, "RULE-CVE-2025-5340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~album_buy_url[^}]{0,80}(?:<[a-z/!][^>]*>|javascript\\\\s*:|data\\\\s*:[^,]*text/html|on(?:error|load|click|mouse)\\\\s*=)~i"}], "cve": "CVE-2025-5340", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5340", "description": "Music Player for Elementor <=2.4.6 authenticated (Contributor+) Stored XSS via album_buy_url widget setting", "method": "POST", "mode": "block", "severity": 6.4, "slug": "music-player-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-5341-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:structure", "type": "regex", "value": "~(?i)(?:\\\\bon[a-zA-Z]+\\\\s*=|<(?:script|img|svg|iframe|object|embed)[\\\\s/>])~"}], "cve": "CVE-2025-5341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5341", "description": "Forminator <=1.44.1 Authenticated (Contributor+) Stored DOM-Based XSS via rating field configuration in forminator_save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forminator", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.44.1"}, "RULE-CVE-2025-53428-01": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-02": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-03": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-04": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53430-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53430-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53441-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53442-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53442-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53443-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53445-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53445-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53446-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53446-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53447-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53447-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53449-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53449-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53453-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53454-01": {"action": "save_post", "conditions": [{"name": "ARGS:ewd_uwpm_email_content", "type": "detectXSS"}], "cve": "CVE-2025-53454", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ultimate-wp-mail", "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2025-5391-01": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated arbitrary file deletion via path traversal in file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5391-02": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|wp-settings\\\\.php)~i"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated sensitive file deletion via file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5398-01": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-02": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-03": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-04": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-05": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-06": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-54003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54007-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2025-54007", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54007", "description": "Post Grid and Gutenberg Blocks <=2.3.11 PHP Object Injection via unserialize() of shortcode/block content (CWE-502)", "mode": "block", "severity": 8.8, "slug": "post-grid", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.11"}, "RULE-CVE-2025-54010-01": {"ajax_action": "fluent_snippets_import_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet import via fluent_snippets_import_json AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54010-02": {"ajax_action": "fluent_snippets_export_snippets", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet export via fluent_snippets_export_snippets AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54049-01": {"ajax_action": "mo_caw_enable_disable_api", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 privilege escalation via mo_caw_enable_disable_api AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-02": {"ajax_action": "mo_caw_get_api_response", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 privilege escalation via mo_caw_get_api_response AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-03": {"ajax_action": "mo_caw_get_nonce", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 nonce leak via mo_caw_get_nonce AJAX enabling privilege escalation (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "nonce-leak"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-04": {"ajax_action": "mo_caw_get_plugin_version_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 information disclosure via mo_caw_get_plugin_version_details AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54049-05": {"ajax_action": "mo_caw_get_table_columns", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-54049", "description": "Custom API for WP <=4.2.2 database schema disclosure via mo_caw_get_table_columns AJAX (missing capability check)", "mode": "block", "severity": 9.9, "slug": "custom-api-for-wp", "tags": ["privilege-escalation", "missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2025-54679-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/ncpc/v1/configs/[0-9]+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54679", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "neon-channel-product-customizer-free", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-54692-01": {"ajax_action": "wps_membership_save_settings_filter", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wps_membership_save_settings_filter"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54692", "method": "POST", "mode": "block", "slug": "membership-for-woocommerce", "target": "plugin", "versions": "<=2.9.0"}, "RULE-CVE-2025-54710-01": {"ajax_action": "ttp_tiktok_clear", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ttp_tiktok_clear"}, {"name": "ARGS:nonce", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54710", "mode": "block", "severity": 7.1, "slug": "b-tiktok-feed", "target": "plugin", "versions": "<=1.0.21"}, "RULE-CVE-2025-54714-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/message(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54714-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/delete(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54734-01": {"ajax_action": "activated_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-02": {"ajax_action": "get_popular_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-03": {"ajax_action": "get_active_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-5486-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpmdbug_submit", "type": "exists"}, {"name": "ARGS:wpmdbug_sendto", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-email-debug", "target": "plugin", "versions": ">=1.0 <=1.2.0"}, "RULE-CVE-2025-5490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "footballpool-options"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|toggle|focus)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<svg[^>]*on|<embed[^>]*>|<object[^>]*>~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 stored XSS via admin settings page option fields", "method": "POST", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5490-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^footballpool-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script|%3[Cc]script|\\\\bon(?:error|load|click|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 reflected XSS via PHP_SELF in admin header on any footballpool admin page", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5490-03": {"ajax_action": "footballpool_calculate_scorehistory", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script|%3[Cc]script|\\\\bon(?:error|load|click|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 reflected XSS via PHP_SELF in score calculation AJAX handler", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "reflected-xss", "php-self", "ajax"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5528-01": {"action": "init", "conditions": [{"name": "ARGS:heateor_mastodon_share", "type": "exists"}, {"name": "ARGS:heateor_mastodon_share", "type": "regex", "value": "~(?:<[a-zA-Z/!]|on(?:load|error|mouseover|click|focus|blur|change|submit|resize|scroll|unload|abort|mouseout|mousedown|mouseup|keydown|keyup|keypress|toggle)[\\\\s]*=|javascript[\\\\s]*:|%(?:3[Cc])[a-zA-Z/!])~i"}], "cve": "CVE-2025-5528", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5528", "description": "Sassy Social Share <=3.3.75 Reflected XSS via heateor_mastodon_share parameter in onclick JS context", "mode": "block", "severity": 6.1, "slug": "sassy-social-share", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.75"}, "RULE-CVE-2025-5532-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "emd_mb_meta"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<(?:script|iframe|embed|object|svg|math|link|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5532-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp_autosave][content]", "type": "contains", "value": "emd_mb_meta"}, {"name": "ARGS:data[wp_autosave][content]", "type": "regex", "value": "~<(?:script|iframe|embed|object|svg|math|link|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in autosave content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5533-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[kbalert\\\\b~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<script|on(?:error|load|click|mouseover|focus|blur|change|input|submit|resize|mouse(?:over|out|enter|leave|move|up|down))\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5533", "description": "Knowledge Base <=2.3.0 authenticated (Contributor+) stored XSS via kbalert shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-5533-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[kbalert\\\\b~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<script|on(?:error|load|click|mouseover|focus|blur|change|input|submit|resize|mouse(?:over|out|enter|leave|move|up|down))\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5533", "description": "Knowledge Base <=2.3.0 authenticated (Contributor+) stored XSS via kbalert shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-5540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[emd_mb_meta\\\\b[^\\\\]]*(?:<[a-z/][^>]*>|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|change|key(?:up|down|press))\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5540", "description": "WP Easy Events <=4.1.0 Authenticated (Contributor+) Stored XSS via emd_mb_meta shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-easy-events", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-5567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Reflected XSS via su_lightbox shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5568-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_location_venue", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_location_venue field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_street", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_street field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_city", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_city field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_state", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_state field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_postcode", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_postcode field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_country", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_country field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_name_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_name_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_email_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_email_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_phone_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_phone_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_address_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_address_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-11": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_tshirt_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_tshirt_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-12": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_gender_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_gender_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-13": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_company_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_company_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-14": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_desg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_desg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-15": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_website_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_website_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-16": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_veg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_veg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-17": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-18": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-19": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-20": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-21": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-22": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-23": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-24": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5585-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5585-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "rest-api", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5588-01": {"action": "init", "conditions": [{"name": "ARGS:download", "type": "detectXSS"}], "cve": "CVE-2025-5588", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5588", "description": "Image Editor by Pixo <=2.3.6 Authenticated (Contributor+) Stored XSS via download parameter in [pixoeditor] shortcode", "mode": "block", "severity": 6.4, "slug": "image-editor-by-pixo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-5673-01": {"action": "admin_init", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on admin page render", "method": "GET", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5673-02": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on b2s_sort_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5678-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5678-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5684-01": {"ajax_action": "metform_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via metform_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5684-02": {"ajax_action": "mf_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via mf_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5692-01": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveCRMconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-02": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveSuiteconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveZohoSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSFSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-05": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on adminAllActionsPRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-06": {"ajax_action": "Sync_settings_PRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on Sync_settings_PRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-07": {"ajax_action": "captcha_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on captcha_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-08": {"ajax_action": "droptable_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on droptable_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-09": {"ajax_action": "TFA_auth_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on TFA_auth_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-10": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_apikey AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-11": {"ajax_action": "createnew_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on createnew_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-12": {"ajax_action": "save_convert_lead", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_convert_lead AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-13": {"ajax_action": "save_campaign_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_campaign_details AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-14": {"ajax_action": "import_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on import_file AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-15": {"ajax_action": "file_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on file_import AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-16": {"ajax_action": "download_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on download_json AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "data-exfiltration"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-17": {"ajax_action": "wp_usersync_assignedto", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on wp_usersync_assignedto AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-18": {"ajax_action": "mappingmodulepro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on mappingmodulepro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-19": {"ajax_action": "saveSyncValue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSyncValue AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-20": {"ajax_action": "send_mapping_configuration", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapping_configuration AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-21": {"ajax_action": "get_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on get_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-22": {"ajax_action": "map_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-23": {"ajax_action": "save_thirdparty_form_title", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_thirdparty_form_title AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-24": {"ajax_action": "send_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-25": {"ajax_action": "delete_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on delete_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-26": {"ajax_action": "zohoCRMRedirect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on zohoCRMRedirect AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-27": {"ajax_action": "save_usersync_RR_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_usersync_RR_option AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-28": {"ajax_action": "customfieldpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on customfieldpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-29": {"ajax_action": "change_ecom_module_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on change_ecom_module_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-30": {"ajax_action": "map_ecom_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_ecom_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-31": {"ajax_action": "map_sync_user_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_sync_user_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-32": {"ajax_action": "selectplugpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on selectplugpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5700-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[simple-logo-carousel[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5700", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5700", "description": "Simple Logo Carousel <=1.9.3 Stored XSS via shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-logo-carousel", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2025-5720-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:author", "type": "detectXSS"}], "cve": "CVE-2025-5720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5720", "description": "Customer Reviews for WooCommerce <=5.80.2 unauthenticated stored XSS via author parameter in AJAX review submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.80.2"}, "RULE-CVE-2025-5753-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:&#0*58;|&#x0*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|&#0*34;|&#0*39;|&quot;|&#x0*22;|&#x0*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5753-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:&#0*58;|&#x0*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|&#0*34;|&#0*39;|&quot;|&#x0*22;|&#x0*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5813-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-amazon-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-amazon-product/v1/keyword REST route enables arbitrary product creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-urls/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-urls/v1/keyword REST route enables SSRF-style URL fetching", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-product/v1/keyword REST route enables unauthorized product data retrieval", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-58207-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/fetch-bulk-alt-text(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/delete-bulk-generating-status(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-03": {"ajax_action": "send_bulk_images", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-58225-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-5841-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode class attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5841-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bstyle\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode style attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5841-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode class attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5841-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bstyle\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode style attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5844-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "radius-blocks/advanced-heading"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"subHeadingTagName\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s<>=;()\'/\\\\\\\\][^\\"]*\\"~"}], "cve": "CVE-2025-5844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5844", "description": "Radius Blocks <=2.2.1 Stored XSS via subHeadingTagName block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "radius-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-5844-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "radius-blocks/advanced-heading"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"subHeadingTagName\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s<>=;()\'/\\\\\\\\][^\\"]*\\"~"}], "cve": "CVE-2025-5844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5844", "description": "Radius Blocks <=2.2.1 Stored XSS via subHeadingTagName block attribute in admin post editor (content param)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "radius-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-5844-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "radius-blocks/advanced-heading"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"subHeadingTagName\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s<>=;()\'/\\\\\\\\][^\\"]*\\"~"}], "cve": "CVE-2025-5844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5844", "description": "Radius Blocks <=2.2.1 Stored XSS via subHeadingTagName block attribute in admin post editor (post_content param)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "radius-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-5845-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~affr/reviews-grid[^}]*\\"numColumns\\"\\\\s*:\\\\s*\\"[^\\"]*[^0-9\\"][^\\"]*\\"~i"}], "cve": "CVE-2025-5845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5845", "description": "Affiliate Reviews <=1.0.6 Stored XSS via numColumns block attribute in reviews-grid block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-reviews", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-5845-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~affr/reviews-table[^}]*\\"numColumns\\"\\\\s*:\\\\s*\\"[^\\"]*[^0-9\\"][^\\"]*\\"~i"}], "cve": "CVE-2025-5845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5845", "description": "Affiliate Reviews <=1.0.6 Stored XSS via numColumns block attribute in reviews-table block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-reviews", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-58592-01": {"ajax_action": "trp_get_translations_regular", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-58592", "description": "TranslatePress <=2.10.2 unauthenticated PHP object injection via trp_get_translations_regular AJAX handler", "mode": "block", "severity": 8.1, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-58592-02": {"ajax_action": "trp_get_translations_gettext", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-58592", "description": "TranslatePress <=2.10.2 unauthenticated PHP object injection via trp_get_translations_gettext AJAX handler", "mode": "block", "severity": 8.1, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-58706-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58706", "description": "woohoo theme <= 1.25 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "woohoo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58706-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58706", "description": "woohoo theme <= 1.25 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "woohoo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58708-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58708", "description": "triple-seven theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "triple-seven", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2025-58708-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58708", "description": "triple-seven theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "triple-seven", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2025-58709-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58709", "description": "legacy theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "legacy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58709-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58709", "description": "legacy theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "legacy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58803-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58803", "description": "algenix theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "algenix", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-58803-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58803", "description": "algenix theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "algenix", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-58879-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58879", "description": "festy theme <= 1.13.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "festy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13.0"}, "RULE-CVE-2025-58879-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58879", "description": "festy theme <= 1.13.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "festy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13.0"}, "RULE-CVE-2025-58885-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58885", "description": "pathfinder theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pathfinder", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58885-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58885", "description": "pathfinder theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pathfinder", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58888-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58888", "description": "theflash theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "theflash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58888-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58888", "description": "theflash theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "theflash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58889-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58889", "description": "towny theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "towny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58889-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58889", "description": "towny theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "towny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58890-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58890", "description": "playful theme <= 1.19.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "playful", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.19.0"}, "RULE-CVE-2025-58890-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58890", "description": "playful theme <= 1.19.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "playful", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.19.0"}, "RULE-CVE-2025-58891-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58891", "description": "sanger theme <= 1.24.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "sanger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.24.0"}, "RULE-CVE-2025-58891-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58891", "description": "sanger theme <= 1.24.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "sanger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.24.0"}, "RULE-CVE-2025-58892-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58892", "description": "tourimo theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tourimo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-58892-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58892", "description": "tourimo theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tourimo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-58893-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58893", "description": "alright theme <= 1.6.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "alright", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2025-58893-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58893", "description": "alright theme <= 1.6.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "alright", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2025-58894-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58894", "description": "good-mood theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "good-mood", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58894-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58894", "description": "good-mood theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "good-mood", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58895-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58895", "description": "integro theme <= 1.8.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "integro", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58895-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58895", "description": "integro theme <= 1.8.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "integro", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58896-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58896", "description": "otaku theme <= 1.8.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "otaku", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58896-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58896", "description": "otaku theme <= 1.8.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "otaku", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58898-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58898", "description": "healthhub theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "healthhub", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58898-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58898", "description": "healthhub theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "healthhub", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58899-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58899", "description": "frame theme <= 2.4.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "frame", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4.0"}, "RULE-CVE-2025-58899-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58899", "description": "frame theme <= 2.4.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "frame", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4.0"}, "RULE-CVE-2025-58900-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58900", "description": "unitravel theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unitravel", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2025-58900-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58900", "description": "unitravel theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unitravel", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2025-58901-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58901", "description": "takeout theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "takeout", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58901-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58901", "description": "takeout theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "takeout", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58923-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58923", "description": "critique theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "critique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58923", "description": "critique theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "critique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58925-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58925", "description": "neptunus theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "neptunus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-58925-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58925", "description": "neptunus theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "neptunus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-58926-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58926", "description": "cerebrum theme <= 1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cerebrum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58926-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58926", "description": "cerebrum theme <= 1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cerebrum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58927-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58927", "description": "stallion theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "stallion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58927-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58927", "description": "stallion theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "stallion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58928-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58928", "description": "heart theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heart", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58928-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58928", "description": "heart theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heart", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58929", "description": "pantry theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pantry", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58929-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58929", "description": "pantry theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pantry", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58930-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58930", "description": "fitflex theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitflex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58930-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58930", "description": "fitflex theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitflex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58931-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58931", "description": "palatio theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palatio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58931-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58931", "description": "palatio theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palatio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58932-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58932", "description": "prisma theme <= 1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "prisma", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10"}, "RULE-CVE-2025-58932-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58932", "description": "prisma theme <= 1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "prisma", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10"}, "RULE-CVE-2025-58933-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58933", "description": "anubis theme <= 1.25 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "anubis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58933-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58933", "description": "anubis theme <= 1.25 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "anubis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58934-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58934", "description": "thegig theme <= 1.18.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "thegig", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-58934-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58934", "description": "thegig theme <= 1.18.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "thegig", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-58935-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58935", "description": "lunna theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lunna", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58935-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58935", "description": "lunna theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lunna", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58936", "description": "catamaran theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catamaran", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58936-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58936", "description": "catamaran theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catamaran", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58937-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58937", "description": "tacticool theme <= 1.0.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tacticool", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.13"}, "RULE-CVE-2025-58937-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58937", "description": "tacticool theme <= 1.0.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tacticool", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.13"}, "RULE-CVE-2025-58940-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58940", "description": "basil theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "basil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-58940-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58940", "description": "basil theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "basil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-58941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58941", "description": "fabric theme <= 1.5.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabric", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2025-58941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58941", "description": "fabric theme <= 1.5.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabric", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2025-58942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58942", "description": "dwell theme <= 1.7.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dwell", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2025-58942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58942", "description": "dwell theme <= 1.7.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dwell", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2025-58943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58943", "description": "agricola theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "agricola", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-58943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58943", "description": "agricola theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "agricola", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-58944-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58944", "description": "manufactory theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "manufactory", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58944-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58944", "description": "manufactory theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "manufactory", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58945-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58945", "description": "ecogrow theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ecogrow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-58945-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58945", "description": "ecogrow theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ecogrow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-58946-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58946", "description": "vocal theme <= 1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "vocal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58946-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58946", "description": "vocal theme <= 1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "vocal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58947-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58947", "description": "athos theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "athos", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58947-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58947", "description": "athos theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "athos", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58948-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58948", "description": "aromatica theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "aromatica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58948-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58948", "description": "aromatica theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "aromatica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58949-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58949", "description": "spock theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "spock", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58949-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58949", "description": "spock theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "spock", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58950-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58950", "description": "lione theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lione", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58950-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58950", "description": "lione theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lione", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-5921-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "sureforms_entries"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-5921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921", "description": "SureForms <=1.7.1 reflected XSS via search parameter in admin entries list table", "method": "GET", "mode": "block", "severity": 5.8, "slug": "sureforms", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5921-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "sureforms_entries"}, {"name": "ARGS:form_id", "type": "detectXSS"}], "cve": "CVE-2025-5921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921", "description": "SureForms <=1.7.1 reflected XSS via form_id parameter in admin entries list table filter", "method": "GET", "mode": "block", "severity": 5.8, "slug": "sureforms", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:the-countdown[\\\\s\\\\S]{0,500}clientId\\\\s*\\"?\\\\s*:\\\\s*\\\\\\"[^\\\\\\"]{0,200}(?:</script|[;=()\\\\x27<>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5929", "description": "The Countdown <=2.0.1 Stored XSS via clientId block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-countdown", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-5950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5953-01": {"ajax_action": "hrm_insert_employee", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2025-5953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5953", "description": "WP Human Resource Management <=2.2.17 missing authorization on hrm_insert_employee allows authenticated privilege escalation via role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hrm", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=2.2.17"}, "RULE-CVE-2025-5957-01": {"ajax_action": "guest_support_handler", "conditions": [{"name": "ARGS:request", "type": "equals", "value": "delete_tickets"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5957", "description": "Guest Support <=1.2.2 missing authorization on mass ticket deletion via guest_support_handler AJAX endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "guest-support", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2025-5961-01": {"ajax_action": "wpvivid_upload_import_files", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:php\\\\d*|phtml|phar|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\x00|%00|$)~i"}], "cve": "CVE-2025-5961", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.116"}, "RULE-CVE-2025-5983-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_meta[type]", "type": "equals", "value": "http-equiv"}, {"name": "ARGS:mtm_meta[value]", "type": "equals", "value": "refresh"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5983", "description": "Meta Tag Manager <3.3 Contributor+ open redirect via http-equiv refresh meta tag injection on post save", "method": "POST", "mode": "block", "severity": 6.5, "slug": "meta-tag-manager", "tags": ["open-redirect", "missing-authorization", "meta-refresh"], "target": "plugin", "versions": "<3.3"}, "RULE-CVE-2025-60041-01": {"ajax_action": "secas_navigate_to_page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-60041", "mode": "block", "severity": 8.8, "slug": "emails-catch-all", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2025-60042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60042-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60043-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60043-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60044-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60044-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60046-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60046-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60047-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60047-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60048-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60048-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60049-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60049-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60050-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60050-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60051-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60051-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60052-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60052-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60053-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60053-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60054-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60054-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60055-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60055-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60056-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60057-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60057-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60060-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60060-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60061-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60061-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60063-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60063-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60065-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60065-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60066-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60067-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60195-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpf_create_account"}, {"name": "ARGS:role", "type": "regex", "value": "~^\\\\s*(?:administrator|editor|author)\\\\s*$~i"}], "cve": "CVE-2025-60195", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-60195", "description": "Atarim Visual Collaboration <=4.2.1 unauthenticated privilege escalation via wpf_create_account AJAX action with attacker-supplied role parameter", "method": "POST", "mode": "block", "severity": 9.8, "slug": "atarim-visual-collaboration", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-60245-01": {"action": "init", "conditions": [{"name": "ARGS:submit_account", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-60245", "description": "WP User Manager <=2.9.12 authenticated PHP object injection via account form deserialization", "mode": "block", "severity": 9.8, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-6025-01": {"ajax_action": "apply_tip", "conditions": [{"name": "ARGS:tip", "type": "regex", "value": "~^\\\\s*-~"}], "cve": "CVE-2025-6025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6025", "description": "Order Tip for WooCommerce <=1.5.4 unauthenticated negative tip manipulation via apply_tip AJAX action", "method": "POST", "mode": "block", "severity": 7.5, "slug": "order-tip-woo", "tags": ["improper-input-validation", "business-logic", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-6068-01": {"ajax_action": "foogallery_attachment_modal_save", "conditions": [{"name": "ARGS:foogallery", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>[^<]*[^<\\\\s]|\\\\bon(?:error|load|mouseover|focus|click|mouseenter)\\\\s*=\\\\s*[\\"\']|(?:[=\\"\'(\\\\s]|^)\\\\s*javascript\\\\s*:\\\\s*(?:void|alert|confirm|prompt|eval|document|window|fetch|location|[(\\\\[\'\\"]|//)~i"}], "cve": "CVE-2025-6068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6068", "description": "FooGallery <=2.4.31 Stored XSS via attachment modal save caption fields", "method": "POST", "mode": "block", "severity": 5.4, "slug": "foogallery", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.31"}, "RULE-CVE-2025-6085-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-6085", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6085", "description": "Make (Integromat) Connector <=1.5.10 arbitrary file upload of executable files via REST media endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "integromat-connector", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.5.10"}, "RULE-CVE-2025-6184-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-6184", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6184", "description": "Tutor LMS Pro <=3.7.0 authenticated SQL injection via order parameter in assignment listing", "method": "GET", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.7.0"}, "RULE-CVE-2025-6190-01": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_capabilities meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-6190-02": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_user_level meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-62007-01": {"ajax_action": "bplvf_save_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_save_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-02": {"ajax_action": "bplvf_delete_user_feedback", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_delete_user_feedback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-03": {"ajax_action": "bplvf_toggle_resolved", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_toggle_resolved"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-04": {"ajax_action": "bplvf_get_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_get_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-6201-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[conversion-pixel[^\\\\]]*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6201", "description": "Pixel Manager for WooCommerce <=1.49.0 Stored XSS via conversion-pixel shortcode attributes in classic editor (REST API JSON body vector not interceptable due to engine limitation)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-google-adwords-conversion-tracking-tag", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.49.0"}, "RULE-CVE-2025-62022-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/buddypress/v1/signups/activate(/|\\\\?|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62022-02": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/buddypress/v1/signups/activate(/|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62065-01": {"ajax_action": "rtm_handle_upload_template", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-62065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62065", "description": "RomethemeKit <=1.6.5 authenticated arbitrary file upload via rtm_handle_upload_template AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-6207-01": {"ajax_action": "wpie_tempalte_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6207", "description": "WP Import Export Lite <=3.9.28 authenticated arbitrary file upload via wpie_tempalte_import AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-import-export-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=3.9.28"}, "RULE-CVE-2025-6212-01": {"ajax_action": "uacf7dp_get_table_data", "conditions": [{"name": "ARGS:form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_get_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6212-02": {"ajax_action": "uacf7dp_view_table_data", "conditions": [{"name": "ARGS:cf7_form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_view_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6213-01": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "preload_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on preload_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6213-02": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "purge_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on purge_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6220-01": {"ajax_action": "uacf7_options_save", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2025-6220", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6220", "description": "Ultimate Addons for Contact Form 7 <=3.5.12 arbitrary file upload via save_options allowing PHP webshell upload to itinerary-fonts directory", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-addons-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.5.12"}, "RULE-CVE-2025-6221-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:embed-bokun/(?:product|product-list)[^>]*\\\\{[^}]*\\"align\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<(?:script|img|iframe|svg|embed|object)\\\\b|\\\\\\\\u003[cC](?:script|img|iframe|svg|embed|object)\\\\b|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|\\\\\\\\[\\"\\\\\\\\]|&(?:quot|apos|#0*34|#0*39);|\\\\\\\\u00(?:22|27))~i"}], "cve": "CVE-2025-6221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6221", "description": "Embed Bokun <=0.23 Stored XSS via align parameter in Gutenberg block attributes within post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-bokun", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.23"}, "RULE-CVE-2025-6236-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:paypal", "type": "detectXSS"}], "cve": "CVE-2025-6236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6236", "description": "Hostel <=1.1.5.8 stored XSS via PayPal email setting on admin options page", "method": "POST", "mode": "block", "severity": 4.8, "slug": "hostel", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1.5.8"}, "RULE-CVE-2025-6236-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:pdt_token", "type": "detectXSS"}], "cve": "CVE-2025-6236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6236", "description": "Hostel <=1.1.5.8 stored XSS via PayPal PDT token setting on admin options page", "method": "POST", "mode": "block", "severity": 4.8, "slug": "hostel", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1.5.8"}, "RULE-CVE-2025-6238-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/mcp/oauth/authorize(?:/|\\\\?|$)|^/\\\\?(?:[^#]*&)?rest_route=/mcp/oauth/authorize(?:[/?&]|$))~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^(?:https?:)?//(?!vulnerable-site\\\\.test(?:/|$))~i"}], "cve": "CVE-2025-6238", "method": "GET", "mode": "block", "severity": 8.0, "slug": "ai-engine", "target": "plugin", "versions": "2.8.4"}, "RULE-CVE-2025-6238-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/mcp/oauth/token(?:/|\\\\?|$)|^/\\\\?(?:[^#]*&)?rest_route=/mcp/oauth/token(?:[/?&]|$))~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^(?:https?:)?//(?!vulnerable-site\\\\.test(?:/|$))~i"}], "cve": "CVE-2025-6238", "method": "POST", "mode": "block", "severity": 8.0, "slug": "ai-engine", "target": "plugin", "versions": "2.8.4"}, "RULE-CVE-2025-6251-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|save_builder)$~"}, {"name": "ARGS:actions", "type": "regex", "value": "~field_id[\\"\']?\\\\s*[:,]\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-6251", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6251", "description": "Royal Elementor Addons <=1.7.1036 Stored XSS via Form Builder field_id in Elementor editor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor", "authenticated"], "target": "plugin", "versions": "<=1.7.1036"}, "RULE-CVE-2025-6251-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS", "type": "regex", "value": "~field_id[\\"\']?\\\\s*[:,]\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-6251", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6251", "description": "Royal Elementor Addons <=1.7.1036 Stored XSS via Form Builder field_id in classic post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor", "authenticated"], "target": "plugin", "versions": "<=1.7.1036"}, "RULE-CVE-2025-6253-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/uielem/v1/prepare_template(?:/|\\\\?|&|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6253", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6253", "description": "UiCore Elements <=1.3.0 unauthenticated arbitrary file read via prepare_template REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "uicore-elements", "tags": ["missing-authorization", "arbitrary-file-read", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-6255-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~dapfforwc[/\\\\\\\\]dynamic-ajax-filter[^}]*className[^}]*(?:<|>|on\\\\w+\\\\s*=|javascript:|\\\\\\\\&quot;|\\\\\\\\u003[ceCE])~i"}], "cve": "CVE-2025-6255", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6255", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via className parameter in Gutenberg block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-6255-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~dapfforwc[/\\\\\\\\]dynamic-ajax-filter[^}]*className[^}]*(?:<|>|on\\\\w+\\\\s*=|javascript:|\\\\\\\\&quot;|\\\\\\\\u003[ceCE])~i"}], "cve": "CVE-2025-6255", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6255", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via className parameter in Gutenberg block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-6256-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~thumbnailHoverEffect[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=|style\\\\s*=)|<\\\\s*(?:script|img|svg|iframe|object|embed|video|audio|math|details|marquee))~i"}], "cve": "CVE-2025-6256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6256", "description": "Flex Guten <=1.2.5 stored XSS via thumbnailHoverEffect block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flex-guten", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-6256-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~thumbnailHoverEffect[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=|style\\\\s*=)|<\\\\s*(?:script|img|svg|iframe|object|embed|video|audio|math|details|marquee))~i"}], "cve": "CVE-2025-6256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6256", "description": "Flex Guten <=1.2.5 stored XSS via thumbnailHoverEffect block attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "flex-guten", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-6256-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~thumbnailHoverEffect[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=|style\\\\s*=)|<\\\\s*(?:script|img|svg|iframe|object|embed|video|audio|math|details|marquee))~i"}], "cve": "CVE-2025-6256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6256", "description": "Flex Guten <=1.2.5 stored XSS via thumbnailHoverEffect block attribute in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flex-guten", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-6257-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:currency|currency_legal)\\\\b[^\\\\]]*(?:<[a-zA-Z/!][^>]*>|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-6257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6257", "description": "Euro FxRef Currency Converter <=2.0.2 Stored XSS via [currency] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "euro-fxref-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-6257-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:currency|currency_legal)\\\\b[^\\\\]]*(?:<[a-zA-Z/!][^>]*>|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-6257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6257", "description": "Euro FxRef Currency Converter <=2.0.2 Stored XSS via [currency] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "euro-fxref-currency-converter", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-6261-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "fleetwire_list"}, {"name": "ARGS:post_content", "type": "regex", "value": "~fleetwire_list[^\\\\]]*(?:<[a-z/!]|(?:&#0*60;|&#x0*3c;|&lt;)[a-z/!]|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseleave|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6261", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6261", "description": "Fleetwire Fleet Management Plugin <=1.0.19 Authenticated (Contributor+) Stored XSS via fleetwire_list shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fleetwire-fleet-management", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-6261-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "fleetwire_list"}, {"name": "ARGS:content", "type": "regex", "value": "~fleetwire_list[^\\\\]]*(?:<[a-z/!]|(?:&#0*60;|&#x0*3c;|&lt;)[a-z/!]|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseleave|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6261", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6261", "description": "Fleetwire Fleet Management Plugin <=1.0.19 Authenticated (Contributor+) Stored XSS via fleetwire_list shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fleetwire-fleet-management", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-6262-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[muse-ai\\\\s[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6262", "description": "Muse.ai Video Embedding <=0.4.1 Stored XSS via muse-ai shortcode event handler injection in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "muse-ai", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-6262-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[muse-ai\\\\s[^\\\\]]*<script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6262", "description": "Muse.ai Video Embedding <=0.4.1 Stored XSS via script tag injection in muse-ai shortcode in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "muse-ai", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-6262-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[muse-ai\\\\s[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6262", "description": "Muse.ai Video Embedding <=0.4.1 Stored XSS via javascript: URI in muse-ai shortcode in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "muse-ai", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-62889-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kingaddons/v1/ajaxselect2/[a-zA-Z0-9_]+/?~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62889", "description": "King Addons for Elementor <=51.1.37 missing authorization on ajaxselect2 REST endpoint", "mode": "block", "severity": 8.8, "slug": "king-addons", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=51.1.37"}, "RULE-CVE-2025-62902-01": {"ajax_action": "shortcode_Api_Add", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "shortcode_Api_Add"}, {"name": "ARGS:getlead", "type": "exists"}], "cve": "CVE-2025-62902", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-popup-builder", "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-62906-01": {"ajax_action": "delete_all_log_link", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_all_log_link"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62906", "method": "POST", "mode": "block", "severity": 9.8, "slug": "referral-link-tracker", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-62915-01": {"ajax_action": "clicksend_send_sms", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "clicksend_send_sms"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62915", "method": "POST", "mode": "block", "severity": 8.1, "slug": "clicksend-contactform7", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-62915-02": {"ajax_action": "delete_message", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_message"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62915", "method": "POST", "mode": "block", "severity": 8.1, "slug": "clicksend-contactform7", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-62918-01": {"ajax_action": "idf_stock_item_click", "conditions": [{"name": "ARGS:idf_stock_item_click", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-62918", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ignitiondeck", "target": "plugin", "versions": "<=2.0.13"}, "RULE-CVE-2025-62919-01": {"ajax_action": "setup_widgets", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "setup_widgets"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62919", "method": "POST", "mode": "block", "severity": 9.1, "slug": "ts-demo-importer", "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-62924-01": {"ajax_action": "post_grid_layout_content_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "post_grid_layout_content_ajax"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62924", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid", "target": "plugin", "versions": "<=2.3.17"}, "RULE-CVE-2025-62925-01": {"ajax_action": "save_analytics_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62925", "method": "POST", "mode": "block", "severity": 8.1, "slug": "enhanced-e-commerce-for-woocommerce-store", "target": "plugin", "versions": "<=7.2.13"}, "RULE-CVE-2025-62925-02": {"ajax_action": "get_analytics_web_properties", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62925", "method": "POST", "mode": "block", "severity": 8.1, "slug": "enhanced-e-commerce-for-woocommerce-store", "target": "plugin", "versions": "<=7.2.13"}, "RULE-CVE-2025-62925-03": {"ajax_action": "get_analytics_account_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62925", "method": "POST", "mode": "block", "severity": 8.1, "slug": "enhanced-e-commerce-for-woocommerce-store", "target": "plugin", "versions": "<=7.2.13"}, "RULE-CVE-2025-62928-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/seo-meta/v1/update/\\\\d+|/(?:index\\\\.php)?\\\\?(?:[^#]*&)?rest_route=/seo-meta/v1/update/\\\\d+)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62928", "method": "POST", "mode": "block", "severity": 8.1, "slug": "seo-meta-description-updater", "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-62931-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(^/wp-json/microsoft/v1/redeemCode(/|\\\\?|$))|(^/\\\\?rest_route=/microsoft/v1/redeemCode(/|&|$))~"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-62931", "method": "POST", "mode": "block", "severity": 8.8, "slug": "microsoft-start", "target": "plugin", "versions": "<=2.8.7"}, "RULE-CVE-2025-62932-01": {"ajax_action": "riovizual_divi_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62932", "method": "POST", "mode": "block", "severity": 8.8, "slug": "riovizual", "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-62935-01": {"ajax_action": "woc_add_schedule", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "woc_add_schedule"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62935", "method": "POST", "mode": "block", "slug": "woc-open-close", "target": "plugin", "versions": "<=4.9.8"}, "RULE-CVE-2025-62938-01": {"ajax_action": "validate_reoon_api", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "validate_reoon_api"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62938", "method": "POST", "mode": "block", "severity": 8.1, "slug": "reoon-email-verifier", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-62938-02": {"ajax_action": "validate_reoon_email", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "validate_reoon_email"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62938", "method": "POST", "mode": "block", "severity": 8.1, "slug": "reoon-email-verifier", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-62938-03": {"ajax_action": "reoon_remove_api_key", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "reoon_remove_api_key"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62938", "method": "POST", "mode": "block", "severity": 8.1, "slug": "reoon-email-verifier", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-62952-01": {"ajax_action": "wpbo_search_response_catlist", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpbo_search_response_catlist"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62952", "method": "POST", "mode": "block", "severity": 8.8, "slug": "chatbot", "target": "plugin", "versions": "<=7.7.3"}, "RULE-CVE-2025-62954-01": {"ajax_action": "rop_notice_dismissed", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rop_notice_dismissed"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62954", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tweet-old-post", "target": "plugin", "versions": "<=9.3.3"}, "RULE-CVE-2025-62965-01": {"ajax_action": "ame_ajax_save_linkcategories", "conditions": [{"name": "ARGS:ame_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62965", "description": "Admin Management Xtended <=2.5.1 missing authorization on ame_ajax_save_linkcategories AJAX action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "admin-management-xtended", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-62967-01": {"ajax_action": "directorypress_save_category_fields_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:term_id", "type": "exists"}], "cve": "CVE-2025-62967", "method": "POST", "mode": "block", "severity": 6.5, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.25"}, "RULE-CVE-2025-62980-01": {"ajax_action": "pfmsz_emptyOptions_AjaxConf", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmsz_emptyOptions_AjaxConf"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-62980-02": {"ajax_action": "pfmdz_writetocssfile_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmdz_writetocssfile_ajax"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-62980-03": {"ajax_action": "pfmdz_nightMode_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmdz_nightMode_ajax"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-62980-04": {"ajax_action": "pfmdz_addgoog_fonts", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmdz_addgoog_fonts"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-63077-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ha_library_new_post"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-63077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-63077", "description": "Happy Addons for Elementor <=3.20.3 missing authorization on ha_library_new_post admin action allows contributor+ users to create arbitrary Theme Builder templates", "mode": "block", "severity": 4.3, "slug": "happy-elementor-addons", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=3.20.3"}, "RULE-CVE-2025-6326-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-6326", "description": "inset theme <= 1.18.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "inset", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-6326-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-6326", "description": "inset theme <= 1.18.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "inset", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-6327-01": {"ajax_action": "king_addons_upload_file", "conditions": [{"name": "ARGS:uploaded_file", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]*|tml?|t|ar)|cgi|fcgi|shtml|asp|aspx|jsp|jspx|sh|bash)($|[?#])~i"}], "cve": "CVE-2025-6327", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6327", "description": "King Addons <=51.1.36 unauthenticated arbitrary file upload via king_addons_upload_file", "method": "POST", "mode": "block", "severity": 10.0, "slug": "king-addons", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=51.1.36"}, "RULE-CVE-2025-6350-01": {"ajax_action": "wpvr_save", "conditions": [{"name": "ARGS:panodata", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|svg|math)[\\\\s/>]|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|change|submit|key(?:up|down|press))\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-6350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6350", "description": "WP VR <=8.5.32 Stored XSS via hotspot-hover in panodata JSON on wpvr_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wpvr", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.5.32"}, "RULE-CVE-2025-6380-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/onlyoffice/oo\\\\.callback(?:/|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6380", "method": "POST", "mode": "block", "severity": 9.8, "slug": "onlyoffice", "target": "plugin", "versions": ">=1.1.0 <=2.2.0"}, "RULE-CVE-2025-6382-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[taeggie-feed[^\\\\]]*name\\\\s*=\\\\s*[\\"\']?[^\\\\]]*(?:<[a-z/!]|on(?:load|error|click|mouse[a-zA-Z0-9_]+|focus|blur)\\\\s*=|javascript:|[\\"\']\\\\s*[);])[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-6382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6382", "description": "Taeggie Feed <=0.1.10 Stored XSS via taeggie-feed shortcode name attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "taeggie-feed", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1.10"}, "RULE-CVE-2025-6462-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[SQLREPORT\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6462", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6462", "description": "EZ SQL Reports <= 5.25.11 Stored XSS via SQLREPORT shortcode name attribute in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elisqlreports", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.25.11"}, "RULE-CVE-2025-6462-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[SQLREPORT\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6462", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6462", "description": "EZ SQL Reports <= 5.25.11 Stored XSS via SQLREPORT shortcode name attribute in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elisqlreports", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.25.11"}, "RULE-CVE-2025-6464-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_form_~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-6464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6464", "description": "Forminator <=1.44.2 unauthenticated PHP Object Injection via form submission PHAR upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "forminator", "tags": ["object-injection", "phar-deserialization", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.44.2"}, "RULE-CVE-2025-6464-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-6464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6464", "description": "Forminator <=1.44.2 unauthenticated PHP Object Injection via multiple file upload PHAR", "method": "POST", "mode": "block", "severity": 8.8, "slug": "forminator", "tags": ["object-injection", "phar-deserialization", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.44.2"}, "RULE-CVE-2025-6540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[web[_-]cam\\\\b[^\\\\]]*\\\\bslug\\\\s*=\\\\s*(?:\\"[^\\"\\\\r\\\\n]*[<>\'\\\\\\\\][^\\"\\\\r\\\\n]*\\"|\'[^\'\\\\r\\\\n]*[<>\\"\\\\\\\\][^\'\\\\r\\\\n]*\')~i"}], "cve": "CVE-2025-6540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6540", "description": "Web Cam <=3.0 Stored XSS via slug shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "web-cam", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2025-6540-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[web[_-]cam\\\\b[^\\\\]]*\\\\bslug\\\\s*=\\\\s*(?:\\"[^\\"\\\\r\\\\n]*[<>\'\\\\\\\\][^\\"\\\\r\\\\n]*\\"|\'[^\'\\\\r\\\\n]*[<>\\"\\\\\\\\][^\'\\\\r\\\\n]*\')~i"}], "cve": "CVE-2025-6540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6540", "description": "Web Cam <=3.0 Stored XSS via slug shortcode attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "web-cam", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2025-6540-03": {"action": "init", "conditions": [{"name": "ARGS:image", "type": "exists"}, {"name": "ARGS:slug", "type": "regex", "value": "~[<>\\"\'\\\\\\\\]~"}], "cve": "CVE-2025-6540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6540", "description": "Web Cam <=3.0 Stored XSS via slug parameter in frontend form submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "web-cam", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2025-6586-01": {"action": "admin_init", "conditions": [{"name": "ARGS:dpwap_locInstall", "type": "exists"}, {"name": "FILES:dpwap_locFiles", "type": "exists"}], "cve": "CVE-2025-6586", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6586", "description": "Download Plugin <=2.2.8 authenticated (Administrator+) arbitrary file upload via dpwap_plugin_locInstall", "method": "POST", "mode": "block", "severity": 7.2, "slug": "download-plugin", "tags": ["arbitrary-file-upload", "file-upload", "remote-code-execution"], "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2025-66054-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/lp/v1/load_content_via_ajax|[?&]rest_route=/lp/v1/load_content_via_ajax)~"}, {"name": "ARGS:callback", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-66054", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.9.4"}, "RULE-CVE-2025-66070-01": {"ajax_action": "wpforo_tag_search", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on\\\\w+\\\\s*=|<svg[^>]+on\\\\w+\\\\s*=|<iframe[\\\\s/>])~i"}], "cve": "CVE-2025-66070", "description": "wpForo Forum <=2.4.10 unauthenticated reflected XSS and information disclosure via wpforo_tag_search AJAX handler", "mode": "block", "severity": 7.5, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2025-66074-01": {"ajax_action": "ironikus_manage_extensions", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-66074", "description": "Unrestricted Upload of File with Dangerous Type in WP Webhooks <= 3.3.8 via nopriv ironikus_manage_extensions", "mode": "block", "severity": 9.0, "slug": "wp-webhooks", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2025-66078-01": {"ajax_action": "mphb_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-66078", "description": "Hotel Booking Lite <=5.2.3 authenticated remote code execution via mphb_install_plugin AJAX handler missing install_plugins capability check", "mode": "block", "severity": 9.1, "slug": "motopress-hotel-booking-lite", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2025-66533-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-66533-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-current-url", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-66533-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-hash", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-66533-04": {"ajax_action": "give_load_receipt", "conditions": [{"name": "ARGS:shortcode_tag", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-6673-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "nsc_eprm_menu_link"}, {"name": "ARGS:content", "type": "regex", "value": "~nsc_eprm_menu_link[^\\\\]]*restaurant_menu_type\\\\s*=\\\\s*([\\"\']).*?\\\\1[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<|>)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6673", "description": "Easy Restaurant Menu Manager <=2.0.1 Stored XSS via nsc_eprm_menu_link shortcode restaurant_menu_type attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-pdf-restaurant-menu-upload", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-6673-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "nsc_eprm_menu_link"}, {"name": "ARGS:content", "type": "regex", "value": "~nsc_eprm_menu_link[^\\\\]]*restaurant_menu_type\\\\s*=\\\\s*([\\"\']).*?\\\\1[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<|>)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6673", "description": "Easy Restaurant Menu Manager <=2.0.1 Stored XSS via nsc_eprm_menu_link shortcode restaurant_menu_type attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-pdf-restaurant-menu-upload", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-6688-01": {"action": "init", "conditions": [{"name": "ARGS:sp_payment", "type": "equals", "value": "callback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6688", "mode": "block", "severity": 9.8, "slug": "simple-payment", "target": "plugin", "versions": ">=1.3.6 <=2.3.8"}, "RULE-CVE-2025-6715-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:layout", "type": "regex", "value": "~(?:\\\\.[\\\\.][\\\\\\\\/]|\\\\.[\\\\.]%2[fF]|\\\\.[\\\\.]%5[cC]|php://|data://|expect://|zip://|phar://)~i"}], "cve": "CVE-2025-6715", "mode": "block", "severity": 9.8, "slug": "latepoint", "target": "plugin", "versions": "<5.1.94"}, "RULE-CVE-2025-6716-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script|<iframe|<svg|<img|<video|<audio|<body|<embed|<object|<marquee|<form|<input|<button|<textarea|<select|<details|<math)(?:\\\\s|/|>)|(?:on(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|unload|resize|scroll|keydown|keyup|keypress)\\\\s*=)|javascript\\\\s*:\\\\s*(?:alert|confirm|prompt|eval|fetch|document|window|location|void|this|atob|setTimeout|setInterval|Function|[\\\\x60\'\\"(])~i"}], "cve": "CVE-2025-6716", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6716", "description": "Contest Gallery <=26.0.8 Authenticated (Author+) Stored XSS via upload title parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=26.0.8"}, "RULE-CVE-2025-6717-01": {"ajax_action": "b1_view_detail_log", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-6717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6717", "description": "B1.lt for WooCommerce <=2.2.56 authenticated SQL injection via id parameter in b1_view_detail_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "b1-accounting", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.2.56"}, "RULE-CVE-2025-6717-02": {"ajax_action": "b1_view_detail_validation_log", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-6717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6717", "description": "B1.lt for WooCommerce <=2.2.56 authenticated SQL injection via id parameter in b1_view_detail_validation_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "b1-accounting", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.2.56"}, "RULE-CVE-2025-6740-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/\\\\d+/feedback(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<iframe|<object|<embed|javascript\\\\s*:|\\\\bon(?:error|load|click|focus|mouseover)\\\\s*=)~i"}], "cve": "CVE-2025-6740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6740", "description": "Contact Form 7 Database Addon <=1.3.1 unauthenticated stored XSS via CF7 form submission fields", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contact-form-cfdb7", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-6740-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cfdb7-list~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<iframe|<object|<embed|javascript\\\\s*:|\\\\bon(?:error|load|click|focus|mouseover)\\\\s*=|\'\\\\s*(?:on\\\\w+|style|class)\\\\s*=)~i"}], "cve": "CVE-2025-6740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6740", "description": "Contact Form 7 Database Addon <=1.3.1 reflected XSS via single-quote attribute breakout on admin list page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "contact-form-cfdb7", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-67467-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]give-paypal-account-connected=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67467", "method": "GET", "mode": "block", "severity": 4.5, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-67467-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]give-paypal-status-refresh=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67467", "method": "GET", "mode": "block", "severity": 4.5, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-67515-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67515", "description": "wilmer theme <= 3.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wilmer", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.5"}, "RULE-CVE-2025-67515-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67515", "description": "wilmer theme <= 3.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wilmer", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.5"}, "RULE-CVE-2025-6754-01": {"ajax_action": "seo_metrics_handle_connect_button_click", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "seo_metrics_handle_connect_button_click"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6754", "method": "POST", "mode": "block", "severity": 8.8, "slug": "seo-metrics-helper", "target": "plugin", "versions": "1.0.5 - 1.0.15"}, "RULE-CVE-2025-6754-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/plugins/seo-metrics-helper/endpoint\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6754", "method": "GET", "mode": "block", "severity": 8.8, "slug": "seo-metrics-helper", "target": "plugin", "versions": "1.0.5 - 1.0.15"}, "RULE-CVE-2025-67563-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "gmail_oauth_redirect"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67563", "method": "GET", "mode": "block", "severity": 5.3, "slug": "post-smtp", "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2025-6757-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rpwe\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|change|submit|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6757", "description": "Recent Posts Widget Extended <=2.0.2 Stored XSS via rpwe shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recent-posts-widget-extended", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-6757-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rpwe\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|change|submit|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6757", "description": "Recent Posts Widget Extended <=2.0.2 Stored XSS via rpwe shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recent-posts-widget-extended", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-67574-01": {"action": "admin_init", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "recreate_db"}], "cve": "CVE-2025-67574", "mode": "block", "severity": 5.3, "slug": "booking-calendar", "target": "plugin", "versions": "<=3.2.30"}, "RULE-CVE-2025-67588-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "POST", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-67588-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "PUT", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-67588-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "PATCH", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-67588-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "DELETE", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-6787-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[smartdocs_search[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6787", "description": "Smart Docs <=1.1.0 Stored XSS via smartdocs_search shortcode attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "smart-docs", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-6787-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[smartdocs_search[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6787", "description": "Smart Docs <=1.1.0 Stored XSS via smartdocs_search shortcode attributes in post content (post_content param)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "smart-docs", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-6787-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[smartdocs_search[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6787", "description": "Smart Docs <=1.1.0 Stored XSS via smartdocs_search shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "smart-docs", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-6792-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/guppylite/v2/channel-authorize(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-6792", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6792", "description": "WP Guppy Lite <=1.1.4 unauthenticated information disclosure via channel-authorize REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpguppy-lite", "tags": ["missing-authentication", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-67934-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67934", "description": "wellspring theme <= 2.8 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wellspring", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.8"}, "RULE-CVE-2025-67934-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67934", "description": "wellspring theme <= 2.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wellspring", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.8"}, "RULE-CVE-2025-67935-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67935", "description": "optimizewp theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "optimizewp", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-67935-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67935", "description": "optimizewp theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "optimizewp", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-67936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67936", "description": "curly theme <= 3.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "curly", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2025-67936-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67936", "description": "curly theme <= 3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "curly", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2025-67937-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67937", "description": "hendon theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hendon", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-67937-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67937", "description": "hendon theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hendon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-67938-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67938", "description": "biagiotti theme <= 3.5.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "biagiotti", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.5.2"}, "RULE-CVE-2025-67938-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67938", "description": "biagiotti theme <= 3.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "biagiotti", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.5.2"}, "RULE-CVE-2025-67940-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67940", "description": "powerlift theme <= 3.2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "powerlift", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.2.1"}, "RULE-CVE-2025-67940-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67940", "description": "powerlift theme <= 3.2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "powerlift", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.2.1"}, "RULE-CVE-2025-67983-01": {"ajax_action": "timezoneByCountry", "conditions": [{"name": "ARGS:code", "type": "regex", "value": "~(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|%3C[a-zA-Z%]|&#x?[0-9a-f]+;?)~i"}], "cve": "CVE-2025-67983", "description": "WP Visitor Statistics (wp-stats-manager) <=8.3 reflected XSS via \'code\' parameter in timezoneByCountry AJAX handler (echoed unsanitized at wsm_init.php:1100).", "mode": "block", "severity": 6.5, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.3"}, "RULE-CVE-2025-68027-01": {"ajax_action": "tfhb_registration", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor)~i"}], "cve": "CVE-2025-68027", "method": "POST", "mode": "block", "severity": 7.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68027-02": {"ajax_action": "tfhb_registration", "conditions": [{"name": "ARGS:user_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor)~i"}], "cve": "CVE-2025-68027", "method": "POST", "mode": "block", "severity": 7.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68027-03": {"ajax_action": "tfhb_registration", "conditions": [{"name": "ARGS:tfhb_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor)~i"}], "cve": "CVE-2025-68027", "method": "POST", "mode": "block", "severity": 7.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68044-01": {"ajax_action": "rtb_cancel_reservations", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-68044", "description": "Five Star Restaurant Reservations <=2.7.4 unauthenticated IDOR allows arbitrary reservation cancellation via rtb_cancel_reservations", "mode": "block", "severity": 8.6, "slug": "restaurant-reservations", "target": "plugin", "versions": "<=2.7.4"}, "RULE-CVE-2025-68044-02": {"ajax_action": "rtb_find_reservations", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-68044", "description": "Five Star Restaurant Reservations <=2.7.4 unauthenticated IDOR allows arbitrary reservation data disclosure via rtb_find_reservations", "mode": "block", "severity": 8.6, "slug": "restaurant-reservations", "target": "plugin", "versions": "<=2.7.4"}, "RULE-CVE-2025-68055-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-json/hydra-booking/v[0-9]+/booking/lists(?:/|\\\\?|$)~i"}, {"name": "ARGS:filter_data", "type": "regex", "value": "~(?i)(?:union\\\\s+(?:all\\\\s+)?select|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|(?:[\'\\"\\\\s])or\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|drop\\\\s+table|information_schema|load_file\\\\s*\\\\(|into\\\\s+(?:out|dump)file|;\\\\s*(?:drop|insert|update|delete)\\\\b)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-68055", "method": "POST", "mode": "block", "severity": 8.5, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68055-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-json/hydra-booking/v[0-9]+/booking/filter(?:/|\\\\?|$)~i"}, {"name": "ARGS:filter_data", "type": "regex", "value": "~(?i)(?:union\\\\s+(?:all\\\\s+)?select|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|(?:[\'\\"\\\\s])or\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|drop\\\\s+table|information_schema|load_file\\\\s*\\\\(|into\\\\s+(?:out|dump)file|;\\\\s*(?:drop|insert|update|delete)\\\\b)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-68055", "method": "GET", "mode": "block", "severity": 8.5, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-6813-01": {"action": "init", "conditions": [{"name": "ARGS:_aap_action", "type": "regex", "value": "~(?i)^auto_login$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6813", "method": "POST", "mode": "block", "severity": 8.8, "slug": "aapanel-wp-toolkit", "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-6813-02": {"action": "init", "conditions": [{"name": "ARGS:_aap_action", "type": "regex", "value": "~(?i)^security_key_info$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6813", "method": "POST", "mode": "block", "severity": 8.8, "slug": "aapanel-wp-toolkit", "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-6815-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:service[name]", "type": "detectXSS"}], "cve": "CVE-2025-6815", "method": "POST", "mode": "block", "severity": 5.5, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-6831-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in classic editor post_content param", "method": "POST", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6831-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6831-03-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in REST API post content (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6831-03-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in REST API post content (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6851-01": {"ajax_action": "blnotifier_blinks", "conditions": [{"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh)://|^https?://(?:localhost(?=[:/]|$)|\\\\[?::1\\\\]?|0\\\\.|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|metadata\\\\.google\\\\.internal(?=[:/]|$)))~i"}], "cve": "CVE-2025-6851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6851", "description": "Broken Link Notifier <=1.3.0 unauthenticated SSRF via blnotifier_blinks AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-notifier", "tags": ["ssrf", "unauthenticated", "cwe-918"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-6851-02": {"ajax_action": "blnotifier_rescan", "conditions": [{"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh)://|^https?://(?:localhost(?=[:/]|$)|\\\\[?::1\\\\]?|0\\\\.|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|metadata\\\\.google\\\\.internal(?=[:/]|$)))~i"}], "cve": "CVE-2025-6851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6851", "description": "Broken Link Notifier <=1.3.0 unauthenticated SSRF via blnotifier_rescan AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-notifier", "tags": ["ssrf", "unauthenticated", "cwe-918"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-6895-01": {"action": "init", "conditions": [{"name": "ARGS:mls_temp_user_token", "type": "exists"}], "cve": "CVE-2025-6895", "method": "GET", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <=2.1.1"}, "RULE-CVE-2025-6895-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_link"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6895", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <2.1.1"}, "RULE-CVE-2025-6895-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "disable_link"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6895", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <2.1.1"}, "RULE-CVE-2025-6895-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "enable_link"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6895", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <2.1.1"}, "RULE-CVE-2025-68974-01": {"ajax_action": "mo_openid_app_instructions", "conditions": [{"name": "ARGS:app_name", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]|(?:php|phar|data|expect|zip)://)~i"}], "cve": "CVE-2025-68974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-68974", "description": "WordPress Social Login and Register <=7.7.0 authenticated local file inclusion via app_name in mo_openid_app_instructions AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "miniorange-login-openid", "tags": ["local-file-inclusion", "path-traversal", "php-stream-wrapper", "authenticated"], "target": "plugin", "versions": "<=7.7.0"}, "RULE-CVE-2025-69034-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69034", "description": "lekker theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lekker", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-69034-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69034", "description": "lekker theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lekker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-69058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69058", "description": "partymaker theme <= 1.1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "partymaker", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.15"}, "RULE-CVE-2025-69058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69058", "description": "partymaker theme <= 1.1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "partymaker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.15"}, "RULE-CVE-2025-69059-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69059", "description": "diveit theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "diveit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69059-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69059", "description": "diveit theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "diveit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69060-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69060", "description": "ureach theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ureach", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69060-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69060", "description": "ureach theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ureach", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69061-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69061", "description": "moveme theme <= 1.2.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "moveme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.15"}, "RULE-CVE-2025-69061-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69061", "description": "moveme theme <= 1.2.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "moveme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.15"}, "RULE-CVE-2025-69062-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69062", "description": "weedles theme <= 1.1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "weedles", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2025-69062-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69062", "description": "weedles theme <= 1.1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "weedles", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2025-69064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69064", "description": "petsland theme <= 1.2.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "petsland", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.8"}, "RULE-CVE-2025-69064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69064", "description": "petsland theme <= 1.2.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "petsland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.8"}, "RULE-CVE-2025-69065-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69065", "description": "snowmountain theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "snowmountain", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69065-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69065", "description": "snowmountain theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "snowmountain", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69066", "description": "indoor-plants theme <= 1.2.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "indoor-plants", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.7"}, "RULE-CVE-2025-69066-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69066", "description": "indoor-plants theme <= 1.2.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "indoor-plants", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.7"}, "RULE-CVE-2025-69067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69067", "description": "tails theme <= 1.4.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tails", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.12"}, "RULE-CVE-2025-69067-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69067", "description": "tails theme <= 1.4.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tails", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.12"}, "RULE-CVE-2025-69068-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69068", "description": "muji theme <= 1.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "muji", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2025-69068-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69068", "description": "muji theme <= 1.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "muji", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2025-69070-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69070", "description": "tornados theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tornados", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2025-69070-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69070", "description": "tornados theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tornados", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2025-69071-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69071", "description": "tantum theme <= 1.1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tantum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-69071-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69071", "description": "tantum theme <= 1.1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tantum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-69072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69072", "description": "prider theme <= 1.1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "prider", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.3.1"}, "RULE-CVE-2025-69072-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69072", "description": "prider theme <= 1.1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "prider", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.3.1"}, "RULE-CVE-2025-69073-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69073", "description": "piqes theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "piqes", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-69073-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69073", "description": "piqes theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "piqes", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-69074-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69074", "description": "pearsonspecter theme <= 1.11.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pearsonspecter", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.11.3"}, "RULE-CVE-2025-69074-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69074", "description": "pearsonspecter theme <= 1.11.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pearsonspecter", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.11.3"}, "RULE-CVE-2025-69075-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69075", "description": "yolox theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "yolox", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-69075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69075", "description": "yolox theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "yolox", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-69076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69076", "description": "modernhousewife theme <= 1.0.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "modernhousewife", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-69076-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69076", "description": "modernhousewife theme <= 1.0.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "modernhousewife", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-69077-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69077", "description": "hobo theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hobo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-69077-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69077", "description": "hobo theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hobo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-69078-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69078", "description": "malta theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "malta", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69078-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69078", "description": "malta theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "malta", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69092-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(\\"key\\"[ ]*:[ ]*\\"on(?:click|dblclick|mouse[a-z]+|key[a-z]+|focus[a-z]*|blur|change|submit|reset|select|load|error|unload|resize|scroll|input|invalid|context[a-z]+|copy|cut|paste|drag[a-z]*|drop|wheel|touch[a-z]+|animation[a-z]+|transition[a-z]+|pointer[a-z]+|abort|cancel|close|before[a-z]+)\\"|\\"key\\"[ ]*:[ ]*\\"href\\"[ ]*,[ ]*\\"value\\"[ ]*:[ ]*\\"[ ]*javascript[ ]*:|\\"value\\"[ ]*:[ ]*\\"[ ]*javascript[ ]*:[^\\"]*\\"[ ]*,[ ]*\\"key\\"[ ]*:[ ]*\\"href\\")~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-69092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-69092", "description": "Essential Addons for Elementor <=6.5.3 Stored XSS via Event Calendar custom_attributes jQuery .attr() injection", "method": "POST", "mode": "block", "severity": 6.5, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-69408-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69408", "description": "healthfirst theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "healthfirst", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2025-69408-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69408", "description": "healthfirst theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "healthfirst", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2025-69409-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69409", "description": "pj theme <= 3.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pj", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=3.0.0"}, "RULE-CVE-2025-69409-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69409", "description": "pj theme <= 3.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pj", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.0.0"}, "RULE-CVE-2025-6941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\s[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|\\\\\'[^\\\\\']*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|[^\\\\]]*?(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f]))~i"}], "cve": "CVE-2025-6941", "method": "POST", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-6941-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/wp/v[12]/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\s[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|\\\\\'[^\\\\\']*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|[^\\\\]]*?(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f]))~i"}], "cve": "CVE-2025-6941", "method": "POST", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-6970-01": {"ajax_action": "search_events", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_events AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-02": {"ajax_action": "search_events_grouped", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_events_grouped AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-03": {"ajax_action": "search_locations", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_locations AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-04": {"ajax_action": "search_tags", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_tags AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-05": {"ajax_action": "search_cats", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_cats AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-06": {"ajax_action": "WP_FullCalendar", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in WP_FullCalendar AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6976-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(events_list|events_calendar|locations_list|events_list_grouped)\\\\b[^\\\\]]*(?:no_results_msg)\\\\s*=[^\\\\]]*<~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6976", "description": "Events Manager <=7.0.3 Stored XSS via shortcode attributes (format_header, format_footer, no_results_msg, format) in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "events-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6976-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(events_list|events_calendar|locations_list|events_list_grouped)\\\\b[^\\\\]]*(?:no_results_msg)\\\\s*=[^\\\\]]*<~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6976", "description": "Events Manager <=7.0.3 Stored XSS via shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "events-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6987-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[advanced_iframe\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousemove|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|/script|img\\\\b[^>]+onerror|svg\\\\b[^>]+onload|iframe\\\\b[^>]+srcdoc))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6987", "description": "Advanced iFrame <=2025.5 authenticated (Contributor+) Stored XSS via advanced_iframe shortcode in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2025.5"}, "RULE-CVE-2025-6987-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[advanced_iframe\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousemove|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|/script|img\\\\b[^>]+onerror|svg\\\\b[^>]+onload|iframe\\\\b[^>]+srcdoc))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6987", "description": "Advanced iFrame <=2025.5 authenticated (Contributor+) Stored XSS via advanced_iframe shortcode in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2025.5"}, "RULE-CVE-2025-6993-01": {"ajax_action": "ewd_uwpm_get_email_log_details", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6993", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-wp-mail", "target": "plugin", "versions": ">=1.0.17 <=1.3.6"}, "RULE-CVE-2025-7035-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode event handler injection in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7035-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode javascript URI injection in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7035-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode event handler injection in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7035-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode javascript URI injection in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7038-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:route_name", "type": "regex", "value": "~^steps__load_step$~i"}, {"name": "ARGS:customer[email]", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7038", "method": "POST", "mode": "block", "severity": 8.2, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-7040-01": {"action": "admin_post_nopriv_set_organization_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "set_organization_settings"}], "cve": "CVE-2025-7040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7040", "method": "POST", "mode": "block", "severity": 8.2, "slug": "cloud-sso-single-sign-on", "tags": ["cwe-862", "missing-authorization", "csrf", "sso"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-7040-02": {"action": "admin_post_set_organization_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "set_organization_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7040", "method": "POST", "mode": "block", "severity": 8.2, "slug": "cloud-sso-single-sign-on", "tags": ["cwe-862", "missing-authorization", "csrf", "sso"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-7045-01": {"action": "init", "conditions": [{"name": "ARGS:csso_action", "type": "equals", "value": "delete_config"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7045", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cloud-sso-single-sign-on", "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-7052-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:route_name", "type": "equals", "value": "customer_cabinet__change_password"}], "cve": "CVE-2025-7052", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-7354-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_(?:button|expand|members|post|user)\\\\s[^\\\\]]*(?:<\\\\s*(?:script|svg|img|iframe|object|embed|video|audio|body|input|details|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|submit|change|input|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-7354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7354", "description": "Shortcodes Ultimate <=7.4.2 Stored XSS via malicious shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.2"}, "RULE-CVE-2025-7354-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_(?:button|expand|members|post|user)\\\\s[^\\\\]]*(?:<\\\\s*(?:script|svg|img|iframe|object|embed|video|audio|body|input|details|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|submit|change|input|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-7354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7354", "description": "Shortcodes Ultimate <=7.4.2 Stored XSS via malicious shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.2"}, "RULE-CVE-2025-7367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpmtst_update_custom_fields"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|<iframe[^>]*>|<svg[^>]*>|<embed[^>]*>|<object[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|beforeprint)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-7367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7367", "description": "Strong Testimonials <=3.2.11 Stored XSS via custom field values on admin-post.php wpmtst_update_custom_fields action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2025-7367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpm-testimonial"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|<iframe[^>]*>|<svg[^>]*>|<embed[^>]*>|<object[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|beforeprint)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-7367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7367", "description": "Strong Testimonials <=3.2.11 Stored XSS via custom field values on post.php wpm-testimonial post type save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2025-7369-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:javascript\\\\s*:|on(?:abort|blur|change|click|dblclick|error|focus|input|keydown|keypress|keyup|load|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|pointerdown|pointerenter|pointerleave|pointermove|pointerout|pointerover|pointerup|reset|resize|scroll|select|submit|touchcancel|touchend|touchmove|touchstart|unload|wheel|animationend|animationiteration|animationstart|transitionend|transitionrun|transitionstart|toggle|contextmenu|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|focusin|focusout|gotpointercapture|lostpointercapture|paste|copy|cut|beforeunload|hashchange|message|offline|online|pagehide|pageshow|popstate|storage|afterprint|beforeprint)\\\\s*=|<(?:iframe|embed|object|form|svg|math)[\\\\s/>])~i"}], "cve": "CVE-2025-7369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7369", "description": "Shortcodes Ultimate <=7.4.2 CSRF to arbitrary shortcode execution via su_generator_preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "shortcodes-ultimate", "tags": ["csrf", "xss", "shortcode-execution"], "target": "plugin", "versions": "<=7.4.2"}, "RULE-CVE-2025-7400-01": {"action": "save_post", "conditions": [{"name": "ARGS:fifu_image_alt", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-7400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7400", "description": "Featured Image from URL <=5.2.7 Stored XSS via fifu_image_alt parameter on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "featured-image-from-url", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-7400-02": {"action": "save_post", "conditions": [{"name": "ARGS:fifu_image_url", "type": "regex", "value": "~(?:javascript\\\\s*:|<[a-z/!?])~i"}], "cve": "CVE-2025-7400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7400", "description": "Featured Image from URL <=5.2.7 Stored XSS via fifu_image_url parameter on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "featured-image-from-url", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-7431-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kb_slug", "type": "regex", "value": "~[<>\\"\']|on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7431", "description": "Knowledge Base <=2.3.1 Authenticated (Administrator+) Stored XSS via kb_slug setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "settings-abuse"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-7431-02": {"action": "admin_init", "conditions": [{"name": "ARGS:category_slug", "type": "regex", "value": "~[<>\\"\']|on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7431", "description": "Knowledge Base <=2.3.1 Authenticated (Administrator+) Stored XSS via category_slug setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "settings-abuse"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-7431-03": {"action": "admin_init", "conditions": [{"name": "ARGS:tag_slug", "type": "regex", "value": "~[<>\\"\']|on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7431", "description": "Knowledge Base <=2.3.1 Authenticated (Administrator+) Stored XSS via tag_slug setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "settings-abuse"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-7437-01": {"action": "init", "conditions": [{"name": "ARGS:md5", "type": "regex", "value": "~[.](?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[^a-zA-Z0-9]|$)~i"}], "cve": "CVE-2025-7437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7437", "description": "Ebook Store <=5.8012 unauthenticated arbitrary file upload via dangerous extension in md5 parameter", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ebook-store", "tags": ["arbitrary-file-upload", "unauthenticated", "rce-via-webshell"], "target": "plugin", "versions": "<=5.8012"}, "RULE-CVE-2025-7437-02": {"action": "init", "conditions": [{"name": "ARGS:md5", "type": "regex", "value": "~[.][.][/\\\\\\\\]~"}], "cve": "CVE-2025-7437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7437", "description": "Ebook Store <=5.8012 unauthenticated path traversal in md5 parameter leading to arbitrary file write", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ebook-store", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.8012"}, "RULE-CVE-2025-7495-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmem_(?:login|reg)_link\\\\s+(?=[^\\\\]]*\\\\b(?!(?:id|class|href)\\\\b)[a-z][a-z0-9_-]*\\\\s*=)~i"}], "cve": "CVE-2025-7495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7495", "description": "WP-Members <=3.5.4.1 Stored XSS via wpmem_login_link/wpmem_reg_link shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.5.4.1"}, "RULE-CVE-2025-7495-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmem_(?:login|reg)_link\\\\s+(?=[^\\\\]]*\\\\b(?!(?:id|class|href)\\\\b)[a-z][a-z0-9_-]*\\\\s*=)~i"}], "cve": "CVE-2025-7495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7495", "description": "WP-Members <=3.5.4.1 Stored XSS via wpmem_login_link/wpmem_reg_link shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.5.4.1"}, "RULE-CVE-2025-7498-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~exad.countdown~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|form|input|button|select|textarea|base|meta|link)(?:\\\\s|/|>)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|leave|move|down|up)|focus|blur|change|submit|reset|key(?:down|up|press)|touch(?:start|end|move)|pointer(?:down|up|over|out|enter|leave|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7498", "description": "Exclusive Addons for Elementor <=2.7.9.4 Stored XSS via Countdown widget labels on post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.7.9.4"}, "RULE-CVE-2025-7498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "contains", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~exad.countdown~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|form|input|button|select|textarea|base|meta|link)(?:\\\\s|/|>)|\\\\bon(?:error|load|click|mouse(?:over|out)|focus|blur|change|submit|key(?:down|up|press))\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7498", "description": "Exclusive Addons for Elementor <=2.7.9.4 Stored XSS via Countdown widget labels on Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "ajax"], "target": "plugin", "versions": "<=2.7.9.4"}, "RULE-CVE-2025-7500-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<script[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon\\\\w+\\\\s*=|\\\\bjavascript\\\\s*:|<(?:iframe|embed|object|svg|math)[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:iframe|embed|object|svg|math)\\\\b)~i"}], "cve": "CVE-2025-7500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7500", "description": "Ocean Social Sharing <=2.2.1 Stored XSS via post_title in wp-admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-social-sharing", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-7500-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:<script[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon\\\\w+\\\\s*=|\\\\bjavascript\\\\s*:|<(?:iframe|embed|object|svg|math)[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:iframe|embed|object|svg|math)\\\\b)~i"}], "cve": "CVE-2025-7500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7500", "description": "Ocean Social Sharing <=2.2.1 Stored XSS via title in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-social-sharing", "tags": ["xss", "stored-xss", "rest-api", "contributor"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-7504-01": {"ajax_action": "friends-load-next-page", "conditions": [{"name": "ARGS:query_vars", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2025-7504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7504", "description": "Friends <=3.5.1 authenticated PHP Object Injection via unserialize of query_vars in friends-load-next-page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "friends", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-7634-01": {"ajax_action": "wte_filter_trips_html", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:\\\\.\\\\.%2[fF])|(?:%2[eE]%2[eE][\\\\\\\\/])|[a-z]+://)~i"}], "cve": "CVE-2025-7634", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7634", "description": "WP Travel Engine <=6.6.7 unauthenticated Local File Inclusion via mode parameter in FilterTripsHtml AJAX controller", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "remote-code-execution"], "target": "plugin", "versions": "<=6.6.7"}, "RULE-CVE-2025-7634-02": {"ajax_action": "wte_load_trips_html", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:\\\\.\\\\.%2[fF])|(?:%2[eE]%2[eE][\\\\\\\\/])|[a-z]+://)~i"}], "cve": "CVE-2025-7634", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7634", "description": "WP Travel Engine <=6.6.7 unauthenticated Local File Inclusion via mode parameter in LoadTripsHtml AJAX controller", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "remote-code-execution"], "target": "plugin", "versions": "<=6.6.7"}, "RULE-CVE-2025-7638-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^forminator-(?:entries|report)$~"}, {"name": "ARGS:order_by", "type": "exists"}, {"name": "ARGS:order_by", "type": "regex", "value": "~^(?!entries\\\\.(?:date_created|entry_id)$).+~i"}], "cve": "CVE-2025-7638", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7638", "description": "Forminator Forms <=1.45.0 authenticated (Administrator+) SQL injection via order_by parameter in entries listing", "method": "GET", "mode": "block", "severity": 4.9, "slug": "forminator", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.45.0"}, "RULE-CVE-2025-7638-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^forminator-(?:entries|report)$~"}, {"name": "ARGS:order", "type": "exists"}, {"name": "ARGS:order", "type": "regex", "value": "~^(?!(?:DESC|ASC)$).+~i"}], "cve": "CVE-2025-7638", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7638", "description": "Forminator Forms <=1.45.0 authenticated (Administrator+) SQL injection via order parameter in entries listing", "method": "GET", "mode": "block", "severity": 4.9, "slug": "forminator", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.45.0"}, "RULE-CVE-2025-7650-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF])~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode path traversal in post_content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7650-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:php://|data://|expect://|phar://|/etc/|/var/|/tmp/|/proc/)~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode PHP wrapper or absolute path in post_content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7650-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF])~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode path traversal in REST API content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7650-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:php://|data://|expect://|phar://|/etc/|/var/|/tmp/|/proc/)~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode PHP wrapper or absolute path in REST API content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7654-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wf_get_cookie\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7654", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7654", "description": "FunnelKit Funnel Builder <=3.11.0.1 sensitive information exposure via wf_get_cookie shortcode in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "funnel-builder", "tags": ["sensitive-info-exposure", "shortcode", "cookie-disclosure", "stored-content"], "target": "plugin", "versions": "<=3.11.0.1"}, "RULE-CVE-2025-7654-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wf_get_cookie\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7654", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7654", "description": "FunnelKit Funnel Builder <=3.11.0.1 sensitive information exposure via wf_get_cookie shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "funnel-builder", "tags": ["sensitive-info-exposure", "shortcode", "cookie-disclosure", "rest-api"], "target": "plugin", "versions": "<=3.11.0.1"}, "RULE-CVE-2025-7661-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[martinus\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|</?script|\\\\\\\\x[0-9a-fA-F]|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7661", "description": "Partnersk\\u00fd syst\\u00e9m Martinus <=1.7.1 Stored XSS via [martinus] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "martinus-partnersky-system", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-7661-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[martinus\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|</?script|\\\\\\\\x[0-9a-fA-F]|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7661", "description": "Partnersk\\u00fd syst\\u00e9m Martinus <=1.7.1 Stored XSS via [martinus] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "martinus-partnersky-system", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-7665-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-admin/)?(?:admin-post\\\\.php|admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:default_user_role", "type": "equals", "value": "administrator"}], "cve": "CVE-2025-7665", "method": "POST", "mode": "block", "severity": 8.1, "slug": "miniorange-firebase-sms-otp-verification", "target": "plugin", "versions": ">=3.1.0 <=3.6.2"}, "RULE-CVE-2025-7670-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/js-archive-list/v1/archive(?:/|[?&]|$)~"}, {"name": "ARGS:include", "type": "detectSQLi"}], "cve": "CVE-2025-7670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7670", "description": "JS Archive List <=6.1.5 unauthenticated SQL injection via include parameter on REST archives endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-7670-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/js-archive-list/v1/archive(?:/|[?&]|$)~"}, {"name": "ARGS:exclude", "type": "detectSQLi"}], "cve": "CVE-2025-7670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7670", "description": "JS Archive List <=6.1.5 unauthenticated SQL injection via exclude parameter on REST archives endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-7689-01": {"ajax_action": "tfhb_reset_password", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:action", "type": "equals", "value": "tfhb_reset_password"}], "cve": "CVE-2025-7689", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hydra-booking", "target": "plugin", "versions": ">=1.1.0 <=1.1.18"}, "RULE-CVE-2025-7695-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/icds/v1/reset_password_link(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-7695", "method": "GET", "mode": "block", "severity": 8.8, "slug": "integration-cds", "target": "plugin", "versions": ">=2.77 <=2.81"}, "RULE-CVE-2025-7695-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/icds/v1/reset_password(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-7695", "method": "POST", "mode": "block", "severity": 8.8, "slug": "integration-cds", "target": "plugin", "versions": ">=2.77 <=2.81"}, "RULE-CVE-2025-7696-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-7696", "method": "POST", "mode": "block", "severity": 9.8, "slug": "integration-for-contact-form-7-and-pipedrive", "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-7697-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-7697", "method": "POST", "mode": "block", "severity": 9.8, "slug": "integration-for-contact-form-7-and-google-sheets", "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-7711-01": {"ajax_action": "rtcl_post_new_listing", "conditions": [{"name": "ARGS:description", "type": "regex", "value": "~\\\\[\\\\s*[A-Za-z_][A-Za-z0-9_-]{2,}[\\\\s\\\\]/]~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-7711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7711", "description": "Classified Listing <=5.0.3 authenticated (Subscriber+) arbitrary shortcode execution via listing description on rtcl_post_new_listing", "method": "POST", "mode": "block", "severity": 5.4, "slug": "classified-listing", "tags": ["code-injection", "shortcode-execution", "authenticated"], "target": "plugin", "versions": "<=5.0.3"}, "RULE-CVE-2025-7711-02": {"ajax_action": "rtcl_update_listing", "conditions": [{"name": "ARGS:description", "type": "regex", "value": "~\\\\[\\\\s*[A-Za-z_][A-Za-z0-9_-]{2,}[\\\\s\\\\]/]~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-7711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7711", "description": "Classified Listing <=5.0.3 authenticated (Subscriber+) arbitrary shortcode execution via listing description on rtcl_update_listing", "method": "POST", "mode": "block", "severity": 5.4, "slug": "classified-listing", "tags": ["code-injection", "shortcode-execution", "authenticated"], "target": "plugin", "versions": "<=5.0.3"}, "RULE-CVE-2025-7722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/bwapi/[0-9]+/site/usermeta/wp_([0-9]+_)?(capabilities|user_level)(?:/)?(?:[?].*)?$~i"}], "cve": "CVE-2025-7722", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7722", "description": "Social Streams <=1.0.1 privilege escalation via update_user_meta() in bwapi usermeta endpoint allows Subscriber+ to set wp_capabilities", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-streams", "tags": ["privilege-escalation", "update-user-meta", "social-streams"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-7727-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:gutenverse/animated-text[^}]*[\\"\']htmlTag[\\"\']\\\\s*:\\\\s*[\\"\']script[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7727", "description": "Gutenverse <=3.1.0 Stored XSS via Animated Text block htmlTag attribute injection through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-7727-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:gutenverse/fun-?fact[^>]*>.*?\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7727", "description": "Gutenverse <=3.1.0 Stored XSS via Fun Fact block event handler injection through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-7780-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleTranscribeAudio(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:(?!https?://)\\\\S+://|/|\\\\.{1,2}/|[A-Za-z]:\\\\\\\\)~i"}], "cve": "CVE-2025-7780", "description": "AI Engine <= 2.9.4 \\u2013 Arbitrary file read via non-HTTP scheme in simpleTranscribeAudio url param (file_get_contents sink)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ai-engine", "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-7808-01": {"action": "init", "conditions": [{"name": "ARGS:product", "type": "detectXSS"}], "cve": "CVE-2025-7808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7808", "description": "WP Shopify <1.5.4 Reflected XSS via product query parameter in [wp-shopify-continue-shopping] shortcode", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-shopify", "tags": ["xss", "reflected-xss", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<1.5.4"}, "RULE-CVE-2025-7813-01": {"action": "init", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|ldap|tftp|expect|php|data|glob|phar|ssh2|ogg|zlib|rar|compress\\\\.zlib)\\\\s*:~i"}], "cve": "CVE-2025-7813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7813", "description": "Eventin <=4.0.37.1 unauthenticated SSRF via proxy_image dangerous URI schemes in url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "tags": ["ssrf", "unauthenticated", "scheme-abuse"], "target": "plugin", "versions": "<=4.0.37.1"}, "RULE-CVE-2025-7813-02": {"action": "init", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|localhost|\\\\[?::1\\\\]?|0x[0-9a-f]+|0[0-7]+\\\\.)~i"}], "cve": "CVE-2025-7813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7813", "description": "Eventin <=4.0.37.1 unauthenticated SSRF via proxy_image internal IP targets in url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "tags": ["ssrf", "unauthenticated", "internal-network"], "target": "plugin", "versions": "<=4.0.37.1"}, "RULE-CVE-2025-7847-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai(?:-ui)?/v1/(?:files/upload|simpleFileUpload)(/|\\\\?|$)~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:php[0-8]?|phps|pht|phtml|phar|cgi|pl|sh|htaccess)$~i"}], "cve": "CVE-2025-7847", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7847", "description": "AI Engine >=2.9.3 <=2.9.4 authenticated arbitrary file upload via simpleFileUpload REST endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["arbitrary-file-upload", "rest-api", "authenticated"], "target": "plugin", "versions": ">=2.9.3 <=2.9.4"}, "RULE-CVE-2025-8059-01": {"ajax_action": "rgfr_registration", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:^|,)\\\\s*administrator\\\\s*(?:,|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8059", "method": "POST", "mode": "block", "severity": 9.8, "slug": "b-blocks", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-8072-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~placeholder_img\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).){0,300}?(?:<script|\\\\bon(?:error|load|mouseover|click|focus|mouseenter)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8072", "description": "Target Video Easy Publish <=3.8.8 Stored XSS via placeholder_img shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brid-video-easy-publish", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.8.8"}, "RULE-CVE-2025-8073-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[plugincy_filters_single\\\\b[^\\\\]]*name\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-8073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8073", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via plugincy_filters_single shortcode name attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-8073-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[plugincy_filters_single\\\\b[^\\\\]]*name\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-8073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8073", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via plugincy_filters_single shortcode name attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-8081-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~tmp_name[\\"\']?\\\\s*[:=]\\\\s*[\\"\']?(?:\\\\.\\\\.[\\\\\\\\/]|/(?:etc|proc|var|usr|home|root)/|[a-zA-Z]:\\\\\\\\|wp-config\\\\.php|%00|\\\\\\\\x00|\\\\\\\\u002e)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8081", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elementor", "target": "plugin", "versions": "<=3.30.2"}, "RULE-CVE-2025-8081-02": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8081", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elementor", "target": "plugin", "versions": "<=3.30.2"}, "RULE-CVE-2025-8084-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/helpers/create-images(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "exists"}, {"name": "ARGS:url", "type": "regex", "value": "~https?://(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0+177\\\\.|0x7f|0x0*a\\\\.|0x0*ac\\\\.(?:1[0-9a-f]|2[0-9a-f]|3[01])|0x0*c0\\\\.a8|localhost|\\\\[?::1\\\\]?|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2025-8084", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-8084-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/helpers/create-images(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-8084", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-8089-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - Classic Editor event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8089-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*(?:<script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - Classic Editor script/javascript injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8089-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - REST API event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8089-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*(?:<script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - REST API script/javascript injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8100-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "marker_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~marker_content[^}]*(?:<\\\\s*script|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg)[^>]*\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8100", "description": "Element Pack Elementor Addons <=8.1.5 Stored XSS via Open Street Map widget marker_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=8.1.5"}, "RULE-CVE-2025-8102-01": {"action": "admin_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:edd-action", "type": "regex", "value": "~^tools_tab_debug_log$~"}], "cve": "CVE-2025-8102", "mode": "block", "severity": 6.5, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<4.0"}, "RULE-CVE-2025-8149-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"athemes-addons-countdown\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"athemes-addons-countdown\\"(?s:.{0,2000})(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-8149", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8149", "description": "aThemes Addons for Elementor <=1.1.2 Stored XSS via Countdown widget attributes through Elementor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-8268-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/mwai-ui/v1/files/list|[?&]rest_route=/mwai-ui/v1/files/list)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8268", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ai-engine", "target": "plugin", "versions": "<=2.9.5"}, "RULE-CVE-2025-8268-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/mwai-ui/v1/files/delete|[?&]rest_route=/mwai-ui/v1/files/delete)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8268", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ai-engine", "target": "plugin", "versions": "<=2.9.5"}, "RULE-CVE-2025-8289-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/\\\\d+/feedback~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-8289", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8289", "description": "Redirection for Contact Form 7 <=3.2.4 PHP Object Injection via deserialization of untrusted form field data", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-8294-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[download_counter_url\\\\s[^\\\\]]*name\\\\s*=\\\\s*(?:\'[^\']*(?:<[^>]+>|on[a-zA-Z]+=)[^\']*\'|\\"[^\\"]*(?:<[^>]+>|on[a-zA-Z]+=)[^\\"]*\\"|[^\\\\]\\\\s\'\\"]*(?:<[^>]+>|on[a-zA-Z]+=)[^\\\\]\\\\s]*)~i"}], "cve": "CVE-2025-8294", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8294", "description": "Download Counter <=1.3 Authenticated (Contributor+) Stored XSS via download_counter_url shortcode name attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "download-counter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-8295-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[emd_form\\\\b[^\\\\]]*noaccess_msg\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}], "cve": "CVE-2025-8295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8295", "description": "Employee Directory <=4.5.1 Authenticated (Contributor+) Stored XSS via noaccess_msg shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-directory", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-8295-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[emd_form\\\\b[^\\\\]]*noaccess_msg\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}], "cve": "CVE-2025-8295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8295", "description": "Employee Directory <=4.5.1 Authenticated (Contributor+) Stored XSS via noaccess_msg shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-directory", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-8316-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[certificawp\\\\s[^\\\\]]*evento\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+>[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-8316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8316", "description": "Certifica WP <=3.1 Stored XSS via evento shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "certifica-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-8316-02": {"action": "init", "conditions": [{"name": "ARGS:certificawp", "type": "regex", "value": "~(?:<[^>]*(?:script|img|svg|iframe|object|embed|link|style|body|marquee|video|audio|details|math|base|form|input|button|select|textarea|keygen|isindex)[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text\\\\/html)~i"}], "cve": "CVE-2025-8316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8316", "description": "Certifica WP <=3.1 Reflected XSS via certificawp GET parameter", "method": "GET", "mode": "block", "severity": 6.4, "slug": "certifica-wp", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-8342-01": {"ajax_action": "lwp_ajax_register", "conditions": [{"name": "ARGS:phone_number", "type": "exists"}], "cve": "CVE-2025-8342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8342", "description": "Login With Phone Number <=1.8.47 unauthenticated authentication bypass via lwp_ajax_register OTP verification logic flaw", "method": "POST", "mode": "block", "severity": 8.1, "slug": "login-with-phone-number", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.8.47"}, "RULE-CVE-2025-8398-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:url|link)\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2025-8398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8398", "description": "azurecurve BBCode <=2.0.4 Stored XSS via [url] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "azurecurve-bbcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-8398-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:url|link)\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2025-8398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8398", "description": "azurecurve BBCode <=2.0.4 Stored XSS via [url] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "azurecurve-bbcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-8416-01": {"ajax_action": "wpf_dynamic_action", "conditions": [{"name": "ARGS:filtersDataBackend", "type": "exists"}, {"name": "ARGS:filtersDataBackend", "type": "regex", "value": "~(?:UNION +(?:ALL +)?SELECT|SELECT +.+? +FROM|INSERT +INTO|UPDATE +[^ ]+ +SET|DELETE +FROM|DROP +(?:TABLE|DATABASE|INDEX)|INTO +(?:OUT|DUMP)FILE|(?:--|/[*]) *(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP)|(?:SLEEP|BENCHMARK|LOAD_FILE|EXTRACTVALUE|UPDATEXML) *[(]|(?:OR|AND) +[0-9]+ *= *[0-9]+|; *(?:DROP|DELETE|INSERT|UPDATE|SELECT))~i"}], "cve": "CVE-2025-8416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8416", "description": "Product Filter by WBW <=2.9.7 unauthenticated SQL injection via filtersDataBackend", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woo-product-filter", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.9.7"}, "RULE-CVE-2025-8420-01": {"ajax_action": "emd_form_builder_lite_pagenum", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?i)\\\\b(?:phpinfo|system|exec|shell_exec|passthru|assert|eval|base64_decode|unlink|file_get_contents|file_put_contents|fopen|fwrite|popen|proc_open|pcntl_exec|dl|mail|header|setcookie|ini_set|ini_restore|putenv|apache_setenv|phpversion|php_uname|php_sapi_name|getmypid|getmyuid|get_current_user|posix_getuid|posix_getpwuid|posix_kill|disk_free_space|disk_total_space|readfile|highlight_file|show_source|wp_die|wp_logout|wp_cache_flush|wp_set_auth_cookie|wp_clear_auth_cookie|delete_option|update_option)\\\\b~"}], "cve": "CVE-2025-8420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8420", "description": "Campus Directory <=1.9.2 unauthenticated limited RCE via dynamic function call in emd_form_builder_lite_pagenum AJAX handler (form parameter)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "campus-directory", "tags": ["remote-code-execution", "eval-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-8420-02": {"ajax_action": "emd_form_builder_lite_pagenum", "conditions": [{"name": "ARGS:app", "type": "regex", "value": "~(?i)\\\\b(?:phpinfo|system|exec|shell_exec|passthru|assert|eval|base64_decode|unlink|file_get_contents|file_put_contents|fopen|fwrite|popen|proc_open|pcntl_exec|dl|mail|header|setcookie|ini_set|ini_restore|putenv|apache_setenv|phpversion|php_uname|php_sapi_name|getmypid|getmyuid|get_current_user|posix_getuid|posix_getpwuid|posix_kill|disk_free_space|disk_total_space|readfile|highlight_file|show_source|wp_die|wp_logout|wp_cache_flush|wp_set_auth_cookie|wp_clear_auth_cookie|delete_option|update_option)\\\\b~"}], "cve": "CVE-2025-8420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8420", "description": "Campus Directory <=1.9.2 unauthenticated limited RCE via dynamic function call in emd_form_builder_lite_pagenum AJAX handler (app parameter)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "campus-directory", "tags": ["remote-code-execution", "eval-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-8425-01": {"ajax_action": "ajax_import_strings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8425", "mode": "block", "severity": 8.8, "slug": "my-wp-translate", "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-8483-01": {"ajax_action": "ajax_validation", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[\\\\s*[a-zA-Z_][a-zA-Z0-9_-]*(?:\\\\s[^\\\\]]*)?\\\\]~"}], "cve": "CVE-2025-8483", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8483", "description": "Discussion Board <= 2.5.5 arbitrary shortcode execution via ajax_validation AJAX handler", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-discussion-board", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.5.5"}, "RULE-CVE-2025-8484-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/|^)wp-content/(?:code-quality-logs/[^/]*[.](log|ini)|_php_errors(?:[.]count)?[.]log|_php_code_control[.]ini)(?:[?#]|$)~i"}], "cve": "CVE-2025-8484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8484", "description": "Code Quality Control Tool <= 2.1 unauthenticated sensitive information exposure via publicly accessible log files", "method": "GET", "mode": "block", "severity": 5.3, "slug": "code-quality-control-tool", "tags": ["information-exposure", "unauthenticated", "log-file-disclosure"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-8484-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/|^)wp-content/code-quality-logs/?(?:[?#]|$)~i"}], "cve": "CVE-2025-8484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8484", "description": "Code Quality Control Tool <= 2.1 unauthenticated directory listing of log directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "code-quality-control-tool", "tags": ["information-exposure", "unauthenticated", "directory-listing"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-8489-01": {"ajax_action": "king_addons_register", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "king_addons_register"}, {"name": "ARGS:user_role", "type": "regex", "value": "~^(administrator|editor|author|contributor|shop_manager)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8489", "method": "POST", "mode": "block", "severity": 9.8, "slug": "king-addons", "target": "plugin", "versions": ">=24.12.92 <=51.1.14"}, "RULE-CVE-2025-8559-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:all-in-one-music-player/music-player-selector\\\\b[\\\\s\\\\S]*?\\"theme\\"\\\\s*:\\\\s*\\"[^\\"]*\\\\.\\\\.[/\\\\\\\\]~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-8559", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8559", "description": "All in One Music Player <=1.3.1 authenticated (Contributor+) path traversal via theme block attribute in post_content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "all-in-one-music-player", "tags": ["path-traversal", "local-file-inclusion", "authenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-8562-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:lens", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{2,}[\\\\\\\\/]+|%2e%2e(?:%2f|%5c)|%252e%252e)~i"}], "cve": "CVE-2025-8562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8562", "description": "Custom Query Shortcode <=0.4.0 authenticated path traversal via lens parameter", "mode": "block", "severity": 6.5, "slug": "custom-query-shortcode", "tags": ["path-traversal", "local-file-inclusion", "shortcode"], "target": "plugin", "versions": "<=0.4.0"}, "RULE-CVE-2025-8562-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:twig_template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{2,}[\\\\\\\\/]+|%2e%2e(?:%2f|%5c)|%252e%252e)~i"}], "cve": "CVE-2025-8562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8562", "description": "Custom Query Shortcode <=0.4.0 authenticated path traversal via twig_template parameter", "mode": "block", "severity": 6.5, "slug": "custom-query-shortcode", "tags": ["path-traversal", "local-file-inclusion", "shortcode"], "target": "plugin", "versions": "<=0.4.0"}, "RULE-CVE-2025-8565-01": {"ajax_action": "gdpr_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-8565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8565", "description": "WP Legal Pages <=3.4.3 missing authorization on gdpr_install_plugin AJAX handler allows arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wplegalpages", "tags": ["missing-authorization", "arbitrary-plugin-install", "broken-access-control"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2025-8566-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~gutenbee/countup[^}]*(?:prefix|suffix)[^}]*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<[^>]+on(?:error|load|click|mouseover|focus)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8566", "description": "GutenBee <=2.18.0 Stored XSS via CountUp block prefix/suffix attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenbee", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2025-8566-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~gutenbee/google-maps[^}]*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<[^>]+on(?:error|load|click|mouseover|focus)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8566", "description": "GutenBee <=2.18.0 Stored XSS via Google Maps block marker popup attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenbee", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2025-8588-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~advgb-map-content[^>]*data-(?:title|desc)[^>]*(?:<(?:script|iframe|svg|img|details|object)[^>]*(?:src\\\\s*=\\\\s*(?:javascript|data):|on[a-zA-Z]+=|[/\\\\s>])|on[a-zA-Z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8588", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8588", "description": "PublishPress Blocks <=3.3.4 Stored XSS via Map block Marker Title/Description in classic admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.3.4"}, "RULE-CVE-2025-8593-01": {"ajax_action": "gs_gravity_install_plugin", "conditions": [{"name": "ARGS:download_url", "type": "regex", "value": "~^(?!https://downloads\\\\.wordpress\\\\.org/).+~i"}], "cve": "CVE-2025-8593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8593", "description": "GSheetConnector for Gravity Forms <=1.3.27 missing authorization on gs_gravity_install_plugin allows subscriber+ arbitrary plugin install via external download_url", "method": "POST", "mode": "block", "severity": 8.8, "slug": "gsheetconnector-gravity-forms", "tags": ["missing-authorization", "privilege-escalation", "rce"], "target": "plugin", "versions": "<=1.3.27"}, "RULE-CVE-2025-8604-01": {"ajax_action": "save_table", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|abort|mousedown|mouseup|keydown|keypress|keyup)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8604", "description": "WP Table Builder <=2.0.12 authenticated (Contributor+) stored XSS via save_table AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-table-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.12"}, "RULE-CVE-2025-8605-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:gutenify/countup(?:-v2)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script[\\\\s>]|(?:iframe|embed|object|svg|img|a)\\\\b[^>]*(?:on[a-z]+=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8605", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8605", "description": "Gutenify <=1.5.9 Authenticated (Contributor+) Stored XSS via Count Up block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenify", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2025-8605-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:gutenify/countup(?:-v2)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script[\\\\s>]|(?:iframe|embed|object|svg|img|a)\\\\b[^>]*(?:on[a-z]+=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8605", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8605", "description": "Gutenify <=1.5.9 Authenticated (Contributor+) Stored XSS via Count Up block attributes in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenify", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2025-8618-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[woosq(?:_btn)?\\\\b[^\\\\]]*(?:<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:)|<script|<iframe|<svg|<embed|<object)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8618", "description": "WPC Smart Quick View for WooCommerce <=4.2.1 Stored XSS via woosq_btn/woosq shortcode attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-smart-quick-view", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-8618-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woosq(?:_btn)?\\\\b[^\\\\]]*(?:<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:)|<script|<iframe|<svg|<embed|<object)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8618", "description": "WPC Smart Quick View for WooCommerce <=4.2.1 Stored XSS via woosq_btn/woosq shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-smart-quick-view", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-8625-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/copypress/v1/image(/|\\\\?|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|t|tml)|phtml)$~i"}], "cve": "CVE-2025-8625", "method": "POST", "mode": "block", "severity": 9.8, "slug": "copypress-rest-api", "target": "plugin", "versions": ">=1.1 <=1.2"}, "RULE-CVE-2025-8625-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/copypress/v1/image(/|\\\\?|$)~"}, {"name": "ARGS:image_url", "type": "regex", "value": "~\\\\.ph(?:p[0-9]?|t|tml)(?:$|[?#])~i"}], "cve": "CVE-2025-8625", "method": "POST", "mode": "block", "severity": 9.8, "slug": "copypress-rest-api", "target": "plugin", "versions": ">=1.1 <=1.2"}, "RULE-CVE-2025-8676-01": {"ajax_action": "get_active_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-8676", "mode": "block", "severity": 4.3, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-8676-02": {"ajax_action": "get_popular_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-8676", "mode": "block", "severity": 4.3, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-8678-01": {"action": "admin_init", "conditions": [{"name": "ARGS:crontrol_action", "type": "equals", "value": "new_url_cron"}, {"name": "ARGS:crontrol_url", "type": "regex", "value": "~(?:^(?!https?://).|://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?(?=[:/\\\\]]|$)|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0x[0-9a-f]+|0[0-3][0-7]{2}\\\\.|metadata\\\\.google\\\\.internal|\\\\d{8,10}(?:[:/]|$)))~i"}], "cve": "CVE-2025-8678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8678", "description": "WP Crontrol 1.17.0-1.19.1 authenticated administrator blind SSRF via new URL cron event creation", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wp-crontrol", "tags": ["ssrf", "authenticated", "cwe-918"], "target": "plugin", "versions": ">=1.17.0 <=1.19.1"}, "RULE-CVE-2025-8678-02": {"action": "admin_init", "conditions": [{"name": "ARGS:crontrol_action", "type": "equals", "value": "edit_url_cron"}, {"name": "ARGS:crontrol_url", "type": "regex", "value": "~(?:^(?!https?://).|://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?(?=[:/\\\\]]|$)|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0x[0-9a-f]+|0[0-3][0-7]{2}\\\\.|metadata\\\\.google\\\\.internal|\\\\d{8,10}(?:[:/]|$)))~i"}], "cve": "CVE-2025-8678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8678", "description": "WP Crontrol 1.17.0-1.19.1 authenticated administrator blind SSRF via edit URL cron event", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wp-crontrol", "tags": ["ssrf", "authenticated", "cwe-918"], "target": "plugin", "versions": ">=1.17.0 <=1.19.1"}, "RULE-CVE-2025-8680-01": {"ajax_action": "fs_api_request", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8680", "method": "POST", "mode": "block", "severity": 4.3, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-8689-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~ep-image-comparison|ep-hotspot|ep-google-maps~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~<script[\\\\s>]|javascript\\\\s*:|<[a-zA-Z][^>]*[[:space:]]+on[a-z]+=|<iframe[\\\\s>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8689", "description": "Elements Plus! <=2.16.4 Stored XSS via Image Comparison, HotSpot Plus, Google Maps widgets (Elementor AJAX save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elements-plus", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.16.4"}, "RULE-CVE-2025-8689-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~ep-image-comparison|ep-hotspot|ep-google-maps~i"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]|javascript\\\\s*:|<[a-zA-Z][^>]*[[:space:]]+on[a-z]+=|<iframe[\\\\s>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8689", "description": "Elements Plus! <=2.16.4 Stored XSS via Image Comparison, HotSpot Plus, Google Maps widgets (Elementor REST save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elements-plus", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.16.4"}, "RULE-CVE-2025-8689-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~ep-image-comparison|ep-hotspot|ep-google-maps~i"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[\\\\s>]|javascript\\\\s*:|<[a-zA-Z][^>]*[[:space:]]+on[a-z]+=|<iframe[\\\\s>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8689", "description": "Elements Plus! <=2.16.4 Stored XSS via Image Comparison, HotSpot Plus, Google Maps widgets (classic editor save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elements-plus", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.16.4"}, "RULE-CVE-2025-8719-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[translate_this\\\\b[^\\\\]]*base_lang\\\\s*=\\\\s*[^\\\\]]*(?:<[a-zA-Z]|on[a-zA-Z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8719", "description": "Translate This gTranslate Shortcode <=1.0 Stored XSS via base_lang shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "translate-this-google-translate-web-element-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-8721-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[workable_jobs\\\\b[^\\\\]]*(?:<script|<iframe|<svg|<img|<object|<embed|<link|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8721", "description": "Workable API <=1.0.4 Stored XSS via workable_jobs shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wrapper-for-workable-api", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-8721-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[workable_jobs\\\\b[^\\\\]]*(?:<script|<iframe|<svg|<img|<object|<embed|<link|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8721", "description": "Workable API <=1.0.4 Stored XSS via workable_jobs shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wrapper-for-workable-api", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-8722-01": {"ajax_action": "pagination_request", "conditions": [{"name": "ARGS:sid", "type": "detectXSS"}], "cve": "CVE-2025-8722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8722", "description": "Content Views <= 4.1 reflected XSS via sid parameter in pagination_request AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-views-query-and-display-post-page", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.1"}, "RULE-CVE-2025-8722-02": {"ajax_action": "preview_request", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>~i"}], "cve": "CVE-2025-8722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8722", "description": "Content Views <= 4.1 stored XSS via preview_request AJAX handler - contributor+ can inject malicious widget attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-views-query-and-display-post-page", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.1"}, "RULE-CVE-2025-8723-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/settings(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~cf_image_resizing_~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8723", "method": "POST", "mode": "block", "severity": 9.8, "slug": "cf-image-resizing", "target": "plugin", "versions": "<=1.5.6"}, "RULE-CVE-2025-8781-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookster/v1/~"}, {"name": "ARGS:raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-8781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8781", "description": "Bookster <=2.1.1 authenticated SQL Injection via raw parameter on REST API endpoints", "mode": "block", "severity": 4.9, "slug": "bookster", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2025-8867-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-8867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8867", "description": "Graphina Elementor Charts and Graphs <=3.1.3 stored XSS via Elementor AJAX save flow", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-8867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-8867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8867", "description": "Graphina Elementor Charts and Graphs <=3.1.3 stored XSS via Elementor REST save flow", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "rest-api", "elementor-widget"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-8896-01": {"action": "init", "conditions": [{"name": "ARGS:gdpr_communication_preferences[/[0-9]+/]", "type": "regex", "value": "~(?:<[a-z/!][^>]*>|on(?:load|error|mouseover|click|focus|blur|mouseout|mousemove|mousedown|mouseup|keydown|keyup|keypress|change|submit|reset|select|abort|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|contextmenu|pointerdown|pointerenter|pointerleave|pointermove|pointerout|pointerover|pointerup) *=|javascript *:)~i"}], "cve": "CVE-2025-8896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8896", "description": "Profile Builder <=3.14.3 Stored XSS via gdpr_communication_preferences[] parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.3"}, "RULE-CVE-2025-8898-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[&?])rest_route=)/(?:tbm|mptbm)/v1/updateuserdetails(/|\\\\?|$)~"}, {"name": "ARGS:username", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8898", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ecab-taxi-booking-manager", "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-8977-01": {"ajax_action": "sdm_export_logs", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-8977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8977", "description": "Simple Download Monitor <=3.9.33 authenticated SQL injection via order parameter in sdm_export_logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-monitor", "tags": ["sql-injection", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2025-8977-02": {"ajax_action": "sdm_export_logs", "conditions": [{"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2025-8977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8977", "description": "Simple Download Monitor <=3.9.33 authenticated SQL injection via orderby parameter in sdm_export_logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-monitor", "tags": ["sql-injection", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2025-8994-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pm/v2/projects/\\\\d+/tasks(?:[/?&]|$)~"}, {"name": "ARGS:completed_at_operator", "type": "regex", "value": "~(?i)(?:OR|AND)\\\\s+(?:SLEEP|BENCHMARK|WAITFOR|IF\\\\s*\\\\(|EXTRACTVALUE|UPDATEXML|\\\\d+\\\\s*=\\\\s*\\\\d+)~"}], "cve": "CVE-2025-8994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8994", "description": "WP Project Manager <=2.6.26 authenticated (Subscriber+) time-based SQL injection via completed_at_operator REST parameter", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wedevs-project-manager", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.6.26"}, "RULE-CVE-2025-9044-01": {"action": "init", "conditions": [{"name": "ARGS:popup_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|javascript\\\\s*:|on(?:load|error|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-9044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9044", "description": "Mapster WP Maps <=1.20.0 reflected XSS via popup_id parameter in shortcode render", "method": "GET", "mode": "block", "severity": 6.4, "slug": "mapster-wp-maps", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2025-9044-02": {"action": "init", "conditions": [{"name": "ARGS:feature_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|javascript\\\\s*:|on(?:load|error|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-9044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9044", "description": "Mapster WP Maps <=1.20.0 reflected XSS via feature_id parameter in modal shortcode render", "method": "GET", "mode": "block", "severity": 6.4, "slug": "mapster-wp-maps", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2025-9044-03": {"ajax_action": "acf_photo_gallery_edit_save", "conditions": [{"name": "ARGS:post", "type": "regex", "value": "~(?:<script[\\\\s/>]|javascript\\\\s*:|on(?:load|error|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-9044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9044", "description": "Mapster WP Maps <=1.20.0 XSS via post parameter in acf_photo_gallery_edit_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mapster-wp-maps", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2025-9045-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eead-countdown~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:prefix_text|suffix_text)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|embed|object|form)\\\\b|<[^>]*\\\\bon\\\\w+\\\\s*=|javascript:|<details[^>]*\\\\bopen\\\\b)~i"}], "cve": "CVE-2025-9045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9045", "description": "Easy Elementor Addons <=2.2.9 Authenticated (Contributor+) Stored XSS via Countdown widget prefix_text/suffix_text", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2025-9045-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eead-image-comparison~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:before_label|after_label)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|embed|object|form)\\\\b|<[^>]*\\\\bon\\\\w+\\\\s*=|javascript:|<details[^>]*\\\\bopen\\\\b)~i"}], "cve": "CVE-2025-9045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9045", "description": "Easy Elementor Addons <=2.2.9 Authenticated (Contributor+) Stored XSS via Image Comparison widget before_label/after_label", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2025-9077-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ut_type_out_animated_heading.{0,500}?(?:<[a-zA-Z/!]|\\\\\\\\u003[cC])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9077", "description": "Ultra Addons Lite for Elementor <=1.1.9 authenticated stored XSS via Typeout Widget Animated Text field (AJAX save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ut-elementor-addons-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-9082-01": {"ajax_action": "save_builder", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "wpb-image_compare"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*script\\\\b|on(?:error|load|click|focus|mouseover)\\\\s*=|javascript\\\\s*:|\\\\\\\\u003c\\\\s*script\\\\\\\\u003e|&#0*60;\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9082", "description": "WPBITS Addons For Elementor <=1.8 Stored XSS via image compare widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpbits-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-9082-02": {"ajax_action": "save_builder", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "wpb-text_rotator"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*script\\\\b|on(?:error|load|click|focus|mouseover)\\\\s*=|javascript\\\\s*:|\\\\\\\\u003c\\\\s*script\\\\\\\\u003e|&#0*60;\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9082", "description": "WPBITS Addons For Elementor <=1.8 Stored XSS via text rotator widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpbits-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-9082-03": {"ajax_action": "save_builder", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "wpb-tooltip"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*script\\\\b|on(?:error|load|click|focus|mouseover)\\\\s*=|javascript\\\\s*:|\\\\\\\\u003c\\\\s*script\\\\\\\\u003e|&#0*60;\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9082", "description": "WPBITS Addons For Elementor <=1.8 Stored XSS via tooltip widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpbits-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-9083-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[+ ]?\\\\d+:\\\\\\\\?\\"[^\\"\\\\\\\\]+\\\\\\\\?\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-9083", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<3.11.1"}, "RULE-CVE-2025-9083-02": {"ajax_action": "nf_ajax_resume", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[+ ]?\\\\d+:\\\\\\\\?\\"[^\\"\\\\\\\\]+\\\\\\\\?\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-9083", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<3.11.1"}, "RULE-CVE-2025-9115-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "etsy-shop.php"}, {"name": "ARGS", "type": "regex", "value": "~(?:<(?:script|svg|img|iframe|embed|object|video|audio|body|details|marquee|math|input|select|textarea|form|meta|link|style|base)[^a-zA-Z0-9]|on(?:load|error|focus|click|mouseover|change|blur|mouseenter|animationend|resize)[ ]*=|javascript[ ]*:)~i"}], "cve": "CVE-2025-9115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9115", "description": "Etsy Shop <=3.0.6 Reflected XSS via unescaped $_SERVER[REQUEST_URI] on admin options page", "mode": "block", "severity": 5.6, "slug": "etsy-shop", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2025-9123-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_cbxgooglemap_heading", "type": "detectXSS"}], "cve": "CVE-2025-9123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9123", "description": "CBX Map for Google Map & OpenStreetMap <=2.0.1 authenticated (Contributor+) stored XSS via popup heading meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cbxgooglemap", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-9123-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_cbxgooglemap_address", "type": "detectXSS"}], "cve": "CVE-2025-9123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9123", "description": "CBX Map for Google Map & OpenStreetMap <=2.0.1 authenticated (Contributor+) stored XSS via location address meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cbxgooglemap", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-9129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[flexi-form-tag\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img[^>]+onerror|<svg[^>]+onload|<iframe)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9129", "description": "Flexi <= 4.28 Stored XSS via flexi-form-tag shortcode in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexi", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=4.28"}, "RULE-CVE-2025-9129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[flexi-form-tag\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img[^>]+onerror|<svg[^>]+onload|<iframe)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9129", "description": "Flexi <= 4.28 Stored XSS via flexi-form-tag shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexi", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=4.28"}, "RULE-CVE-2025-9130-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[unify_checkout\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|change|submit|focusin)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9130", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9130", "description": "Unify <=3.4.7 Authenticated (Contributor+) Stored XSS via unify_checkout shortcode token attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "unify", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2025-9130-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[unify_checkout\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|change|submit|focusin)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9130", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9130", "description": "Unify <=3.4.7 Authenticated (Contributor+) Stored XSS via unify_checkout shortcode token attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "unify", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2025-9172-01": {"ajax_action": "vibes_get_stats", "conditions": [{"name": "ARGS:resource", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|SLEEP[\\\\s/\\\\*]*[(]|BENCHMARK[\\\\s/\\\\*]*[(]|EXTRACTVALUE[\\\\s/\\\\*]*[(]|UPDATEXML[\\\\s/\\\\*]*[(]|(?:^|[\\\\s)])(?:AND|OR)[\\\\s/\\\\*]+(?:[0-9]|SLEEP|BENCHMARK|[(]SELECT)|[\'\\"]\\\\s*(?:AND|OR|UNION|;\\\\s*SELECT)\\\\s)~i"}], "cve": "CVE-2025-9172", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9172", "description": "Vibes <=2.2.0 unauthenticated SQL injection via resource parameter in vibes_get_stats AJAX handler", "mode": "block", "severity": 7.5, "slug": "vibes", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-9203-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~subtitle_ssize[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via subtitle_ssize widget field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~track_title[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_title widget field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~track_artist_name[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_artist_name widget field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~subtitle_ssize[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via subtitle_ssize in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "elementor-ajax"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-05": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~track_title[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_title in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "elementor-ajax"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-06": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~track_artist_name[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_artist_name in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "elementor-ajax"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9204-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~xaddons_button_url[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9204", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9204", "description": "X Addons for Elementor <=1.0.16 authenticated (Contributor+) stored XSS via _elementor_data on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "x-addons-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.16"}, "RULE-CVE-2025-9209-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/users(?:/[0-9]+)?(?:/|\\\\?|&|$)|(?:^|&|\\\\?)rest_route=(?:/|%2[Ff])wp(?:/|%2[Ff])v2(?:/|%2[Ff])users(?:(?:/|%2[Ff])[0-9]+)?(?:/|%2[Ff]|\\\\?|&|$))~i"}, {"type": "missing_capability", "value": "list_users"}], "cve": "CVE-2025-9209", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9209", "description": "RestroPress <=3.2.1 unauthenticated information exposure of user private tokens via /wp/v2/users REST endpoint enabling JWT forgery", "method": "GET", "mode": "block", "severity": 9.8, "slug": "restropress", "tags": ["information-exposure", "authentication-bypass", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=3.0.0 <=3.2.1"}, "RULE-CVE-2025-9215-01": {"ajax_action": "storeengine_csv/file_download", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-9215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9215", "description": "StoreEngine <=1.5.0 authenticated path traversal via file_download AJAX handler (filename parameter with directory traversal sequences)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "storeengine", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-9215-02": {"ajax_action": "storeengine_csv/file_download", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-9215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9215", "description": "StoreEngine <=1.5.0 authenticated sensitive file read via file_download AJAX handler (filename parameter targeting known sensitive files)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "storeengine", "tags": ["path-traversal", "arbitrary-file-read", "sensitive-file-read", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-9216-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "storeengine_csv/import"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9216", "description": "StoreEngine <=1.5.0 authenticated arbitrary file upload via storeengine_csv/import AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "storeengine", "tags": ["arbitrary-file-upload", "missing-authorization", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-9219-01": {"ajax_action": "update_post_smtp_pro_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9219", "method": "POST", "mode": "block", "severity": 4.3, "slug": "post-smtp", "target": "plugin", "versions": "<=3.4.1"}, "RULE-CVE-2025-9243-01": {"ajax_action": "get_cc_orders", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9243", "description": "Cost Calculator Builder <=3.5.32 missing authorization on get_cc_orders AJAX handler allowing Subscriber+ order data access", "method": "POST", "mode": "block", "severity": 8.1, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=3.5.32"}, "RULE-CVE-2025-9243-02": {"ajax_action": "update_order_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9243", "description": "Cost Calculator Builder <=3.5.32 missing authorization on update_order_status AJAX handler allowing Subscriber+ order modification", "method": "POST", "mode": "block", "severity": 8.1, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=3.5.32"}, "RULE-CVE-2025-9260-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/profile\\\\.php~"}, {"name": "ARGS:description", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2025-9260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9260", "description": "Fluent Forms 5.1.16-6.1.1 PHP Object Injection via serialized payload in user profile description (profile.php)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "fluentform", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": ">=5.1.16 <=6.1.1"}, "RULE-CVE-2025-9260-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/users(/|\\\\?|$)~"}, {"name": "ARGS:description", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2025-9260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9260", "description": "Fluent Forms 5.1.16-6.1.1 PHP Object Injection via serialized payload in user profile description (REST API)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "fluentform", "tags": ["object-injection", "deserialization", "authenticated", "rest-api"], "target": "plugin", "versions": ">=5.1.16 <=6.1.1"}, "RULE-CVE-2025-9277-01": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_titles_desc", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via SEO meta fields in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-02": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_titles_title", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via SEO title field in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-03": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_fb_title", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Facebook OG title in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-04": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_fb_desc", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Facebook OG description in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-05": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_twitter_title", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Twitter title in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-06": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_twitter_desc", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Twitter description in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-07": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_canonical_url", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:|<\\\\s*script|(?:^|[\\\\s\\"\'<>])on[a-zA-Z]+\\\\s*=)~i"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via canonical URL field in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-08": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_redirections_value", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:|<\\\\s*script|(?:^|[\\\\s\\"\'<>])on[a-zA-Z]+\\\\s*=)~i"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via redirection value field in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9286-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appy-pie-connect-for-woocommerce/v1/reset_user_password(?:/|\\\\?|&|$)~"}], "cve": "CVE-2025-9286", "method": "POST", "mode": "block", "severity": 9.8, "slug": "appy-pie-connect-for-woocommerce", "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-9318-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quizzes/[0-9]+/results(?:/|\\\\?|&|$)~"}, {"name": "ARGS:is_linking", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]|SLEEP[\\\\s/\\\\*]*[(]|BENCHMARK[\\\\s/\\\\*]*[(]|(?:^|[\\\\s\'\\"])OR[\\\\s/\\\\*]+[0-9]|(?:^|[\\\\s\'\\"])AND[\\\\s/\\\\*]+[0-9]|SELECT[\\\\s/\\\\*]+(?:NULL|[0-9]|user_|@@|concat|group_concat|information_schema))~i"}], "cve": "CVE-2025-9318", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9318", "description": "Quiz and Survey Master (QSM) <=10.3.1 authenticated SQL injection via is_linking REST API parameter", "method": "GET", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=10.3.1"}, "RULE-CVE-2025-9322-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpfs-form-name", "type": "detectSQLi"}], "cve": "CVE-2025-9322", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9322", "description": "WP Full Stripe Free <=8.3.1 unauthenticated SQL injection via wpfs-form-name parameter in wpfs-check-coupon AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-full-stripe-free", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2025-9343-01": {"ajax_action": "eh_crm_new_ticket_post", "conditions": [{"name": "ARGS:subject", "type": "detectXSS"}], "cve": "CVE-2025-9343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9343", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.4 unauthenticated stored XSS via ticket subject in eh_crm_new_ticket_post", "method": "POST", "mode": "block", "severity": 7.2, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.4"}, "RULE-CVE-2025-9344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[uwp_profile(?:_header)?\\\\s+[^\\\\]]*disable_greedy\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9344", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9344", "description": "UsersWP <=1.2.42 Stored XSS via disable_greedy shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "userswp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.42"}, "RULE-CVE-2025-9344-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[uwp_profile(?:_header)?\\\\s+[^\\\\]]*disable_greedy\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9344", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9344", "description": "UsersWP <=1.2.42 Stored XSS via disable_greedy shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "userswp", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.42"}, "RULE-CVE-2025-9353-01": {"ajax_action": "tb_save_data", "conditions": [{"name": "ARGS:builder_data", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-9353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9353", "description": "Themify Builder <=7.6.9 authenticated (Contributor+) Stored XSS via builder_data parameter in tb_save_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.6.9"}, "RULE-CVE-2025-9353-02": {"ajax_action": "tb_render_element", "conditions": [{"name": "ARGS:batch", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-9353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9353", "description": "Themify Builder <=7.6.9 authenticated (Contributor+) Stored XSS via batch parameter in tb_render_element AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.6.9"}, "RULE-CVE-2025-9378-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "vayu-blocks/lottie"}, {"name": "ARGS:post_content", "type": "regex", "value": "~vayu-blocks/lottie[\\\\s\\\\S]{0,1000}(?:[\\"\']\\\\s*(?:on(?:mouse(?:over|enter|leave|move|out|down|up)|click|dblclick|key(?:down|up|press)|focus|blur|load|error|submit|change|input|scroll|wheel|drag|drop|touch(?:start|end|move|cancel)|pointer(?:down|up|move|enter|leave|over|out)|animation(?:start|end|iteration)|transition(?:end|run|start))\\\\s*=)|<\\\\s*script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-9378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9378", "description": "Vayu Blocks <=1.3.9 Stored XSS via unescaped Lottie block attributes in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vayu-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.9"}, "RULE-CVE-2025-9378-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "vayu-blocks/lottie"}, {"name": "ARGS:content", "type": "regex", "value": "~vayu-blocks/lottie[\\\\s\\\\S]{0,1000}(?:[\\"\']\\\\s*(?:on(?:mouse(?:over|enter|leave|move|out|down|up)|click|dblclick|key(?:down|up|press)|focus|blur|load|error|submit|change|input|scroll|wheel|drag|drop|touch(?:start|end|move|cancel)|pointer(?:down|up|move|enter|leave|over|out)|animation(?:start|end|iteration)|transition(?:end|run|start))\\\\s*=)|<\\\\s*script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-9378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9378", "description": "Vayu Blocks <=1.3.9 Stored XSS via unescaped Lottie block attributes in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vayu-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=1.3.9"}, "RULE-CVE-2025-9436-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9436-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*><~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in REST API post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9436-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9436-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*><~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in classic editor post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9463-01": {"ajax_action": "pp-analytics-query", "conditions": [{"name": "ARGS:order_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|IF|CASE)\\\\s*\\\\(|--\\\\s*$|/\\\\*|\\\\*/|#\\\\s)~i"}], "cve": "CVE-2025-9463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9463", "description": "PeachPay for WooCommerce <=1.117.5 authenticated SQL injection via order_by parameter in pp-analytics-query AJAX handler", "mode": "block", "severity": 6.5, "slug": "peachpay-for-woocommerce", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.117.5"}, "RULE-CVE-2025-9463-02": {"ajax_action": "pp-analytics-query", "conditions": [{"name": "ARGS:group_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|IF|CASE)\\\\s*\\\\(|--\\\\s*$|/\\\\*|\\\\*/|#\\\\s)~i"}], "cve": "CVE-2025-9463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9463", "description": "PeachPay for WooCommerce <=1.117.5 authenticated SQL injection via group_by parameter in pp-analytics-query AJAX handler", "mode": "block", "severity": 6.5, "slug": "peachpay-for-woocommerce", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.117.5"}, "RULE-CVE-2025-9485-01": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^eyJhbGciOiJub25lI~"}], "cve": "CVE-2025-9485", "method": "GET", "mode": "block", "severity": 9.8, "slug": "miniorange-login-with-eve-online-google-facebook", "target": "plugin", "versions": "<=6.26.12"}, "RULE-CVE-2025-9485-02": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^eyJhbGciOiJub25lI~"}], "cve": "CVE-2025-9485", "method": "POST", "mode": "block", "severity": 9.8, "slug": "miniorange-login-with-eve-online-google-facebook", "target": "plugin", "versions": "<=6.26.12"}, "RULE-CVE-2025-9487-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}], "cve": "CVE-2025-9487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9487", "description": "Admin and Site Enhancements <=7.9.7 authenticated stored XSS via malicious SVG upload through REST API media endpoint (ARGS:name)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "admin-site-enhancements", "tags": ["xss", "stored-xss", "svg-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.9.7"}, "RULE-CVE-2025-9487-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|&|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}], "cve": "CVE-2025-9487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9487", "description": "Admin and Site Enhancements <=7.9.7 authenticated stored XSS via malicious SVG upload through REST API media endpoint (FILES:file:name)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "admin-site-enhancements", "tags": ["xss", "stored-xss", "svg-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.9.7"}, "RULE-CVE-2025-9488-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with HTML tags in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\][^\\\\[]*<(script|iframe|svg|img|details|object|embed|video|audio|input|form)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode enclosed content with HTML tags in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*\\\\bon\\\\w+\\\\s*=[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with event handlers in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with HTML tags in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\][^\\\\[]*<(script|iframe|svg|img|details|object|embed|video|audio|input|form)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode enclosed content with HTML tags in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*\\\\bon\\\\w+\\\\s*=[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with event handlers in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9493-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ame-user-info [^\\\\]]*placeholder[ ]*=[ ]*(?:\\"[^\\"\\\\]]*|\'[^\'\\\\]]*)(?:<[ ]*script|javascript[ ]*:|on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|keypress)[ ]*=)~i"}], "cve": "CVE-2025-9493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9493", "description": "Admin Menu Editor <=1.14 Stored XSS via [ame-user-info] shortcode placeholder attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "admin-menu-editor", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.14"}, "RULE-CVE-2025-9493-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ame-user-info [^\\\\]]*placeholder[ ]*=[ ]*(?:\\"[^\\"\\\\]]*|\'[^\'\\\\]]*)(?:<[ ]*script|javascript[ ]*:|on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|keypress)[ ]*=)~i"}], "cve": "CVE-2025-9493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9493", "description": "Admin Menu Editor <=1.14 Stored XSS via [ame-user-info] shortcode placeholder attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "admin-menu-editor", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.14"}, "RULE-CVE-2025-9496-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[file_modified\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2025-9496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9496", "description": "Enable Media Replace <=4.1.6 Stored XSS via file_modified shortcode format attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.6"}, "RULE-CVE-2025-9496-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[file_modified\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2025-9496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9496", "description": "Enable Media Replace <=4.1.6 Stored XSS via file_modified shortcode format attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.1.6"}, "RULE-CVE-2025-9499-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[oceanwp_library\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<|on[a-z]+=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9499", "description": "Ocean Extra <=2.4.9 Stored XSS via oceanwp_library shortcode id attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-9500-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)<(?:script|img|svg|iframe|object|embed|form|input|body|style|link|meta|base)[\\\\s/>]~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in post_content (classic editor - HTML tags)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)on(?:load|error|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in post_content (classic editor - event handlers)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)javascript\\\\s*:~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in post_content (classic editor - javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)<(?:script|img|svg|iframe|object|embed|form|input|body|style|link|meta|base)[\\\\s/>]~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in REST API content (Gutenberg - HTML tags)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)on(?:load|error|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in REST API content (Gutenberg - event handlers)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)javascript\\\\s*:~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in REST API content (Gutenberg - javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9501-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?.*)?$~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<!--\\\\s*mfunc\\\\b~i"}], "cve": "CVE-2025-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9501", "description": "W3 Total Cache < 2.8.13 command injection via mfunc tags in unauthenticated comments processed by _parse_dynamic_mfunc, as described by NVD and WPScan and detailed in SiteGuarding advisories.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["rce", "command_injection", "comments", "w3-total-cache", "mfunc", "cwe-78"], "target": "plugin", "versions": "<2.8.13"}, "RULE-CVE-2025-9501-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?.*)?$~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<!--\\\\s*mclude\\\\b~i"}], "cve": "CVE-2025-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9501", "description": "W3 Total Cache < 2.8.13 command injection attempts using mclude fragment tags in unauthenticated comments evaluated by _parse_dynamic_mfunc, per NVD, WPScan, and SiteGuarding analyses.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["rce", "command_injection", "comments", "w3-total-cache", "mclude", "cwe-78"], "target": "plugin", "versions": "<2.8.13"}, "RULE-CVE-2025-9512-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<[a-z][^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512", "description": "Schema & Structured Data for WP & AMP <=1.49 unauthenticated stored XSS via comment HTML attribute injection", "method": "POST", "mode": "block", "severity": 6.1, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=1.49"}, "RULE-CVE-2025-9512-02": {"ajax_action": "saswp_rf_template_review_edit_form", "conditions": [{"name": "ARGS:comment_id", "type": "regex", "value": "~<[^>]*>|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512", "description": "Schema & Structured Data for WP & AMP <=1.49 reflected XSS via unsanitized comment_id in review edit form AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "reflected-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.49"}, "RULE-CVE-2025-9512-03": {"ajax_action": "saswp_rf_template_review_edit_form", "conditions": [{"name": "ARGS:comment_post_id", "type": "regex", "value": "~<[^>]*>|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512", "description": "Schema & Structured Data for WP & AMP <=1.49 reflected XSS via unsanitized comment_post_id in review edit form AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "reflected-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.49"}, "RULE-CVE-2025-9519-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[easy_timer_(?:clock|counter|countdown|countup)[^\\\\]]*filter\\\\s*=\\\\s*[\\"\'\\\\\\\\]?\\\\s*(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|preg_replace|create_function|call_user_func|call_user_func_array|array_map|array_filter|usort|uasort|uksort)\\\\b~i"}], "cve": "CVE-2025-9519", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9519", "description": "Easy Timer <=4.2.1 authenticated (Editor+) RCE via shortcode filter attribute in post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-timer", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-9519-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[easy_timer_(?:clock|counter|countdown|countup)[^\\\\]]*filter\\\\s*=\\\\s*[\\"\'\\\\\\\\]?\\\\s*(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|preg_replace|create_function|call_user_func|call_user_func_array|array_map|array_filter|usort|uasort|uksort)\\\\b~i"}], "cve": "CVE-2025-9519", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9519", "description": "Easy Timer <=4.2.1 authenticated (Editor+) RCE via shortcode filter attribute in REST API post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-timer", "tags": ["code-injection", "rce", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-9539-01": {"ajax_action": "automatorwp_ajax_import_automation_from_url", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "automatorwp_ajax_import_automation_from_url"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9539", "method": "POST", "mode": "block", "severity": 8.0, "slug": "automatorwp", "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-9541-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\]\\\\s*\\\\(\\\\s*(?:(?:javascript|vbscript|data)\\\\s*:|[^)]*?on(?:error|load|click|focus|mouseover)\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9541", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9541", "description": "Markup Markdown <3.20.10 Authenticated (Contributor+) Stored XSS via markdown post content (post.php)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "markup-markdown", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<3.20.10"}, "RULE-CVE-2025-9541-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\]\\\\s*\\\\(\\\\s*(?:(?:javascript|vbscript|data)\\\\s*:|[^)]*?on(?:error|load|click|focus|mouseover)\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9541", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9541", "description": "Markup Markdown <3.20.10 Authenticated (Contributor+) Stored XSS via markdown post content (REST API)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "markup-markdown", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.20.10"}, "RULE-CVE-2025-9562-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[qs_date\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\'][^\\"\']*[<>][^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-9562", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2025-9562-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content[raw]", "type": "regex", "value": "~\\\\[qs_date\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\'][^\\"\']*[<>][^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-9562", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2025-9565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "blocksy_newsletter_subscribe"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9565", "description": "Blocksy Companion <=2.1.10 Stored XSS via blocksy_newsletter_subscribe shortcode description attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-9565-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "blocksy_newsletter_subscribe"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9565", "description": "Blocksy Companion <=2.1.10 Stored XSS via blocksy_newsletter_subscribe shortcode description attribute via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-9620-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_integration_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via integration code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9620-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_ga_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via GA code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9620-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_gtm_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via GTM code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9620-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_custom_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via custom code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9637-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quizzes(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-9637", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9637", "description": "Quiz and Survey Master <=10.3.1 missing authorization on REST API quiz listing endpoint", "method": "GET", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "tags": ["missing-authorization", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=10.3.1"}, "RULE-CVE-2025-9710-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php(?:\\\\?|$)~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<[^>]*\\\\s(?:on\\\\w+\\\\s*=|style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:expression|url)\\\\s*\\\\()|<\\\\s*(?:script|iframe|embed|object|applet|form|svg|math)\\\\b|\\\\bjavascript\\\\s*:|\\\\bvbscript\\\\s*:|\\\\bdata\\\\s*:[^,]*text/html)~i"}], "cve": "CVE-2025-9710", "method": "POST", "mode": "block", "severity": 6.3, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2025-9776-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/catf/v1/import-csv(/|\\\\?|&|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9776", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9776", "description": "CatFolders <=2.5.2 authenticated (Author+) time-based SQL injection via CSV import REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "catfolders", "tags": ["sql-injection", "rest-api", "csv-import", "authenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2025-9807-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "ARGS:post_type", "type": "equals", "value": "tribe_events"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via s search parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "search-parameter"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9807-02": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:/events/|/tribe_events/)~i"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via s parameter on events archive", "method": "GET", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "search-parameter"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9807-03": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^tribe_events~"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via s parameter on AJAX views fallback", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9807-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe/events/v1/events~"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via search parameter on REST API", "method": "GET", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9816-01": {"ajax_action": "wp_statistics_delete_agents", "conditions": [{"name": "ARGS:agent-name", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 hardening - XSS-shaped agent-name in the authenticated wp_statistics_delete_agents admin AJAX action. Not the CVE-2025-9816 injection vector (see RULE-CVE-2025-9816-06); this callback requires the manage capability plus a valid wps_nonce and escapes its echo with esc_attr()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "authenticated", "hardening", "defense-in-depth"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-02": {"ajax_action": "wp_statistics_delete_platforms", "conditions": [{"name": "ARGS:platform-name", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 hardening - XSS-shaped platform-name in the authenticated wp_statistics_delete_platforms admin AJAX action. Not the CVE-2025-9816 injection vector (see RULE-CVE-2025-9816-06); this callback requires the manage capability plus a valid wps_nonce and escapes its echo with esc_attr()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "authenticated", "hardening", "defense-in-depth"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-03": {"ajax_action": "wp_statistics_delete_ip", "conditions": [{"name": "ARGS:ip-address", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 hardening - XSS-shaped ip-address in the authenticated wp_statistics_delete_ip admin AJAX action. Not the CVE-2025-9816 injection vector (see RULE-CVE-2025-9816-06); this callback requires the manage capability plus a valid wps_nonce and escapes its echo with esc_attr()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "authenticated", "hardening", "defense-in-depth"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-04": {"ajax_action": "wp_statistics_purge_data", "conditions": [{"name": "ARGS:purge-days", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 hardening - XSS-shaped purge-days in the authenticated wp_statistics_purge_data admin AJAX action. Not the CVE-2025-9816 injection vector (see RULE-CVE-2025-9816-06); this callback requires the manage capability plus a valid wps_nonce and casts the parameter with intval() before use", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "authenticated", "hardening", "defense-in-depth"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-05": {"ajax_action": "wp_statistics_purge_visitor_hits", "conditions": [{"name": "ARGS:purge-hits", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 hardening - XSS-shaped purge-hits in the authenticated wp_statistics_purge_visitor_hits admin AJAX action. Not the CVE-2025-9816 injection vector (see RULE-CVE-2025-9816-06); this callback requires the manage capability plus a valid wps_nonce and casts the parameter with intval() before use", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "authenticated", "hardening", "defense-in-depth"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-06": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:User-Agent", "type": "regex", "value": "~<\\\\s{0,8}/?\\\\s{0,8}(?:script|img|svg|iframe|object|embed|body|video|audio|details|marquee|input|form|style|base|meta|link|math|template|xmp|isindex|animate|set)[\\\\s/>]|\\\\bon(?:error|load|click|focus|blur|toggle|start|begin|show|scroll|wheel|submit|change|input|select|play|ended|abort|resize|pageshow|animation(?:start|end|iteration)|transitionend|mouse(?:over|out|move|enter|leave|down|up)|pointer(?:over|out|down|up|enter|move)|key(?:down|up|press)|touch(?:start|move|end)|drag|drop|copy|cut|paste|contextmenu|auxclick)\\\\s{0,8}=|javascript\\\\s{0,8}:~i"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 unauthenticated stored XSS via the User-Agent request header - UserAgent::getHttpUserAgent() passes the raw header to DeviceDetector and the parsed agent/platform/device/model values are stored on the visitor row and echoed unescaped by the admin Devices report templates. Fixed in 14.15.5 by sanitize_text_field() on the raw header, so this rule matches XSS markup in User-Agent on any request that can reach hit recording", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "stored-xss", "unauthenticated", "user-agent"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9852-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[momoyoga-schedule\\\\b[^\\\\]]*schedule_url\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script|&#|&quot;|%22|%3c)~i"}], "cve": "CVE-2025-9852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9852", "description": "Yoga Schedule Momoyoga <=2.9.0 Stored XSS via [momoyoga-schedule] shortcode schedule_url attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "momoyoga-integration", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.9.0"}, "RULE-CVE-2025-9852-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[momoyoga-schedule\\\\b[^\\\\]]*schedule_url\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script|&#|&quot;|%22|%3c)~i"}], "cve": "CVE-2025-9852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9852", "description": "Yoga Schedule Momoyoga <=2.9.0 Stored XSS via [momoyoga-schedule] shortcode schedule_url attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "momoyoga-integration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.9.0"}, "RULE-CVE-2025-9853-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[optio-lightbox\\\\b[^\\\\]]*(?:\'\\\\s*[);]|<script|on(?:error|load|mouseover|click|focus)\\\\s*=|\\\\\\">\\\\s*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9853", "description": "Optio Dentistry <=2.2 authenticated (Contributor+) stored XSS via optio-lightbox shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "optio-dentistry", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-9856-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sg_popup\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9856", "description": "Popup Builder <=4.4.1 authenticated (Contributor+) stored XSS via sg_popup shortcode event handler attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "popup-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2025-9856-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sg_popup\\\\b[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9856", "description": "Popup Builder <=4.4.1 authenticated (Contributor+) stored XSS via sg_popup shortcode javascript: URI in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "popup-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2025-9856-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sg_popup\\\\b[^\\\\]]*<script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9856", "description": "Popup Builder <=4.4.1 authenticated (Contributor+) stored XSS via sg_popup shortcode script tag injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "popup-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2025-9857-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[Heateor_Facebook_Login"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[Heateor_Facebook_Login\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9857", "description": "Heateor Login <=1.1.9 Stored XSS via Heateor_Facebook_Login shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "heateor-login", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-9858-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[abf_vehicle\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-9858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9858", "description": "Auto Bulb Finder <=2.8.0 Stored XSS via abf_vehicle shortcode attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auto-bulb-finder-for-wp-wc", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2025-9858-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[abf_vehicle\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-9858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9858", "description": "Auto Bulb Finder <=2.8.0 Stored XSS via abf_vehicle shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auto-bulb-finder-for-wp-wc", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2025-9859-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fintelligence-calculator\\\\b[^\\\\]]*(?:<[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9859", "description": "Fintelligence Calculator <=1.0.3 authenticated stored XSS via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fintelligence-calculator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-9859-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fintelligence-calculator\\\\b[^\\\\]]*(?:<[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9859", "description": "Fintelligence Calculator <=1.0.3 authenticated stored XSS via shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fintelligence-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-9860-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mixtape\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9860", "description": "Mixtape <=1.1 Stored XSS via [mixtape] shortcode attributes in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mixtape", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-9860-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mixtape\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9860", "description": "Mixtape <=1.1 Stored XSS via [mixtape] shortcode attributes in content param (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mixtape", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-9860-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mixtape\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9860", "description": "Mixtape <=1.1 Stored XSS via [mixtape] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mixtape", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-9861-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[los_showposts\\\\b[^\\\\]]*(?:<[a-zA-Z/!]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-9861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9861", "description": "ThemeLoom Widgets <=1.8.5 Stored XSS via los_showposts shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeloom-widgets", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-9861-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[los_showposts\\\\b[^\\\\]]*(?:<[a-zA-Z/!]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-9861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9861", "description": "ThemeLoom Widgets <=1.8.5 Stored XSS via los_showposts shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeloom-widgets", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-9873-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<(?:img|iframe|video|embed|source)\\\\b[^>]*\\\\s+on[a-z]+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9873", "description": "a3 Lazy Load <=2.7.5 Stored XSS via HTML event handler attribute injection in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "tags": ["xss", "stored-xss", "attribute-injection"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-9873-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:img|iframe|video|embed|source)\\\\b[^>]*\\\\s+on[a-z]+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9873", "description": "a3 Lazy Load <=2.7.5 Stored XSS via HTML event handler attribute injection in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "tags": ["xss", "stored-xss", "attribute-injection", "rest-api"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-9874-01": {"action": "init", "conditions": [{"name": "ARGS:ucl_page", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.)|(?:php|data|expect|phar)://~i"}], "cve": "CVE-2025-9874", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9874", "description": "Ultimate Classified Listings <=1.6 Local File Inclusion via ucl_page parameter in uclwp_dashboard shortcode", "method": "GET", "mode": "block", "severity": 7.5, "slug": "ultimate-classified-listings", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-9875-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ticket_spot\\\\b[^\\\\]]*(?:<script|on(?:mouse|key|focus|blur|load|error|click|dblclick|change|submit|reset|select|abort|resize|scroll|unload|before)\\\\w*\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9875", "description": "Event Tickets, RSVPs, Calendar (TicketSpot) <=1.0.2 authenticated (Contributor+) stored XSS via ticket_spot shortcode widget_id attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ticket-spot", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-9875-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ticket_spot\\\\b[^\\\\]]*(?:<script|on(?:mouse|key|focus|blur|load|error|click|dblclick|change|submit|reset|select|abort|resize|scroll|unload|before)\\\\w*\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9875", "description": "Event Tickets, RSVPs, Calendar (TicketSpot) <=1.0.2 authenticated (Contributor+) stored XSS via ticket_spot shortcode widget_id attribute (REST)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ticket-spot", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-9881-01": {"ajax_action": "ub_ajax_action_callback", "conditions": [{"name": "ARGS:linkpartner", "type": "regex", "value": "~<[a-zA-Z/!]|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|submit|change|resize|scroll|keydown|keyup|keypress|mouseout|mousedown|mouseup|dblclick|contextmenu|paste|copy|cut|drag(?:start|end|enter|leave|over)?|drop|abort|unload|beforeunload|hashchange|message|popstate|input|animationend|transitionend)\\\\s*=~i"}], "cve": "CVE-2025-9881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9881", "description": "Ultimate Blogroll <=2.5.2 unauthenticated stored XSS via linkpartner parameter in ub_ajax_action_callback AJAX handler", "mode": "block", "severity": 6.1, "slug": "ultimate-blogroll", "tags": ["xss", "stored-xss", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2025-9883-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "browser-sniff"}, {"name": "ARGS:bs_submit", "type": "exists"}, {"name": "ARGS:bs_before", "type": "detectXSS"}], "cve": "CVE-2025-9883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9883", "description": "Browser Sniff <=2.3 CSRF to Stored XSS via bs_before settings parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "browser-sniff", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-9883-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "browser-sniff"}, {"name": "ARGS:bs_submit", "type": "exists"}, {"name": "ARGS:bs_after", "type": "detectXSS"}], "cve": "CVE-2025-9883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9883", "description": "Browser Sniff <=2.3 CSRF to Stored XSS via bs_after settings parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "browser-sniff", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-9883-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "browser-sniff"}, {"name": "ARGS:bs_submit", "type": "exists"}, {"name": "ARGS:bs_between", "type": "detectXSS"}], "cve": "CVE-2025-9883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9883", "description": "Browser Sniff <=2.3 CSRF to Stored XSS via bs_between settings parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "browser-sniff", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-9892-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~page=restrict-user-registration~"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:usernames_error", "type": "detectXSS"}], "cve": "CVE-2025-9892", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9892", "description": "Restrict User Registration <=1.0.1 CSRF to Stored XSS via usernames_error parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "restrict-user-registration", "tags": ["csrf", "xss", "settings-update"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-9892-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~page=restrict-user-registration~"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:emails_error", "type": "detectXSS"}], "cve": "CVE-2025-9892", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9892", "description": "Restrict User Registration <=1.0.1 CSRF to Stored XSS via emails_error parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "restrict-user-registration", "tags": ["csrf", "xss", "settings-update"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-9892-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~page=restrict-user-registration~"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:services_error", "type": "detectXSS"}], "cve": "CVE-2025-9892", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9892", "description": "Restrict User Registration <=1.0.1 CSRF to Stored XSS via services_error parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "restrict-user-registration", "tags": ["csrf", "xss", "settings-update"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-9947-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "custom-404-pro"}, {"name": "ARGS:path", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND)\\\\s+[0-9]|\\\\b(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\b|[\'\\")][\\\\s]*--|(?:^|[^0-9a-zA-Z_])[0-9]+\\\\s+OR\\\\s+[0-9])~i"}], "cve": "CVE-2025-9947", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9947", "description": "Custom 404 Pro <=3.12.0 authenticated SQL injection via path parameter in delete_logs admin handler", "method": "GET", "mode": "block", "severity": 4.9, "slug": "custom-404-pro", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.12.0"}, "RULE-CVE-2025-9950-01": {"ajax_action": "rrrlgvwr_get_file", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|^[a-zA-Z]:[\\\\\\\\/])~"}], "cve": "CVE-2025-9950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9950", "description": "Error Log Viewer by BestWebSoft <=1.1.6 authenticated directory traversal via rrrlgvwr_get_file AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "error-log-viewer", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-9967-01": {"ajax_action": "ihs_otp_reset_ajax_hook", "conditions": [{"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:new_password", "type": "exists"}], "cve": "CVE-2025-9967", "method": "POST", "mode": "block", "severity": 9.8, "slug": "orion-sms-otp-verification", "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-9975-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-scraper"}, {"name": "ARGS:action", "type": "equals", "value": "extract"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|169\\\\.254\\\\.169\\\\.254|metadata\\\\.google\\\\.internal|metadata\\\\.azure\\\\.com)|(?:^|//)(?:10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)|(?:^|//)0(?:x[0-9a-fA-F]+|[0-7]+)(?:\\\\.|/|$)|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2025-9975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9975", "description": "WP Scraper <=5.8.1 authenticated SSRF via action=extract url parameter targeting internal/cloud metadata endpoints", "method": "GET", "mode": "block", "severity": 6.8, "slug": "wp-scraper", "tags": ["ssrf", "server-side-request-forgery", "cloud-metadata", "authenticated"], "target": "plugin", "versions": "<=5.8.1"}, "RULE-CVE-2025-9975-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-scraper"}, {"name": "ARGS:action", "type": "equals", "value": "downloader"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|169\\\\.254\\\\.169\\\\.254|metadata\\\\.google\\\\.internal|metadata\\\\.azure\\\\.com)|(?:^|//)(?:10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)|(?:^|//)0(?:x[0-9a-fA-F]+|[0-7]+)(?:\\\\.|/|$)|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2025-9975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9975", "description": "WP Scraper <=5.8.1 authenticated SSRF via action=downloader url parameter targeting internal/cloud metadata endpoints", "method": "GET", "mode": "block", "severity": 6.8, "slug": "wp-scraper", "tags": ["ssrf", "server-side-request-forgery", "cloud-metadata", "authenticated"], "target": "plugin", "versions": "<=5.8.1"}, "RULE-CVE-2025-9984-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/debug-posts/[0-9]+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-9984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9984", "description": "Featured Image from URL <=5.2.7 unauthenticated access to debug-posts REST endpoint exposes private/password-protected posts", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9984-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/debug-slug/[a-zA-Z0-9_-]+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-9984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9984", "description": "Featured Image from URL <=5.2.7 unauthenticated access to debug-slug REST endpoint exposes private/password-protected posts", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9984-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/debug-postmeta/[0-9]+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-9984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9984", "description": "Featured Image from URL <=5.2.7 unauthenticated access to debug-postmeta REST endpoint exposes private/password-protected post metadata", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9985-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]uploads[/\\\\\\\\]fifu-(plugin|cloud)\\\\.log([?/]|$)~i"}], "cve": "CVE-2025-9985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9985", "description": "Featured Image from URL <=5.2.7 unauthenticated sensitive log file disclosure via direct access to fifu-plugin.log or fifu-cloud.log in uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["information-disclosure", "sensitive-log-exposure", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9990-01": {"action": "init", "conditions": [{"name": "ARGS:portal_type", "type": "regex", "value": "~([/\\\\\\\\]|%2[fF]|%5[cC]|\\\\.\\\\.|(\\\\.|%2[eE]){2}|%00|[a-zA-Z]+://)~"}], "cve": "CVE-2025-9990", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9990", "description": "WordPress Helpdesk Integration <=5.8.10 unauthenticated Local File Inclusion via portal_type parameter", "mode": "block", "severity": 8.1, "slug": "wp-helpdesk-integration", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.8.10"}, "RULE-CVE-2025-9992-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:meta[ghostkit_page_js]", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9992", "description": "Ghost Kit <=3.4.3 Authenticated (Contributor+) Stored XSS via ghostkit_page_js post meta field on REST API post update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ghostkit", "tags": ["xss", "stored-xss", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-0548-01": {"ajax_action": "tutor_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0548", "description": "Tutor LMS <=3.9.4 missing authorization on tutor_import_settings AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.4"}, "RULE-CVE-2026-0548-02": {"ajax_action": "load_saved_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0548", "description": "Tutor LMS <=3.9.4 missing authorization on load_saved_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.4"}, "RULE-CVE-2026-0548-03": {"ajax_action": "reset_settings_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0548", "description": "Tutor LMS <=3.9.4 missing authorization on reset_settings_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.4"}, "RULE-CVE-2026-0549-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[groups_group_info\\\\b[^\\\\]]*(?:single|plural|none)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+>[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0549", "description": "Groups <=3.10.0 Stored XSS via groups_group_info shortcode attributes (single/plural/none) in post content submitted through post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "groups", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2026-0549-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[groups_group_info\\\\b[^\\\\]]*(?:single|plural|none)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+>[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0549", "description": "Groups <=3.10.0 Stored XSS via groups_group_info shortcode attributes (single/plural/none) in post content submitted through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "groups", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2026-0550-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mycred_load_coupon\\\\b[^\\\\]]*\\\\b(?:label|button|placeholder)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0550", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mycred", "target": "plugin", "versions": "<=2.9.7.3"}, "RULE-CVE-2026-0551-01": {"action": "init", "conditions": [{"name": "ARGS:post_protection_roles", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-0551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0551", "description": "PPWP - Password Protect Pages <=1.9.18 PHP Object Injection via post_protection_roles parameter", "mode": "block", "severity": 8.8, "slug": "password-protect-page", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.9.18"}, "RULE-CVE-2026-0552-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|post)$~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wpsc_display_product|wp_cart_display_product)\\\\b(?=[^\\\\]]*\\\\b(?:product_id|id)\\\\s*=\\\\s*[\\"\']?\\\\d+[\\"\']?)(?=[^\\\\]]*\\\\b(?:thumb|thumbnail|description|template|style|class)\\\\s*=\\\\s*[\\"\'][^\\"\\\\]]*(?:<\\\\s*(?:script|img|svg)\\\\b|on[a-z]{3,}\\\\s*=|javascript\\\\s*:))(?=[^\\\\]]*[\\"\'])[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0552", "description": "Simple Shopping Cart <=5.2.4 Contributor+ stored XSS via wpsc_display_product shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.2.4"}, "RULE-CVE-2026-0554-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics/regenerate(?:[/?]|$)~"}, {"type": "missing_capability", "value": "edit_notificationx"}], "cve": "CVE-2026-0554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0554", "description": "NotificationX <=3.1.11 missing authorization on analytics/regenerate REST endpoint allows contributor+ analytics reset", "mode": "block", "severity": 4.3, "slug": "notificationx", "tags": ["missing-authorization", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=3.1.11"}, "RULE-CVE-2026-0554-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics/reset(?:[/?]|$)~"}, {"type": "missing_capability", "value": "edit_notificationx"}], "cve": "CVE-2026-0554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0554", "description": "NotificationX <=3.1.11 missing authorization on analytics/reset REST endpoint allows contributor+ analytics reset", "mode": "block", "severity": 4.3, "slug": "notificationx", "tags": ["missing-authorization", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=3.1.11"}, "RULE-CVE-2026-0555-01": {"ajax_action": "premmerce_wizard_actions", "conditions": [{"name": "ARGS:state", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0555", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0555", "description": "Premmerce <=1.3.20 authenticated stored XSS via premmerce_wizard_actions state parameter (all update sub-actions)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "premmerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.3.20"}, "RULE-CVE-2026-0556-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[xo_event_field\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<(?:script|img|svg|iframe|object|embed))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0556", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0556", "description": "XO Event Calendar <=3.2.10 Authenticated (Contributor+) Stored XSS via xo_event_field shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "xo-event-calendar", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.10"}, "RULE-CVE-2026-0556-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[xo_event_field\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<(?:script|img|svg|iframe|object|embed))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0556", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0556", "description": "XO Event Calendar <=3.2.10 Authenticated (Contributor+) Stored XSS via xo_event_field shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "xo-event-calendar", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.10"}, "RULE-CVE-2026-0557-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "[wpda_app"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpda_app\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b[^>]*\\\\bonerror\\\\s*=|<svg\\\\b[^>]*\\\\bonload\\\\s*=|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0557", "description": "WP Data Access <=5.5.63 Stored XSS via wpda_app shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-data-access", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.5.63"}, "RULE-CVE-2026-0557-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[wpda_app"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpda_app\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b[^>]*\\\\bonerror\\\\s*=|<svg\\\\b[^>]*\\\\bonload\\\\s*=|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0557", "description": "WP Data Access <=5.5.63 Stored XSS via wpda_app shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-data-access", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.5.63"}, "RULE-CVE-2026-0559-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[stm_lms_courses_grid_display\\\\s+[^\\\\]]*(?:<script|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-0559", "method": "POST", "mode": "block", "severity": 6.4, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<=3.7.11"}, "RULE-CVE-2026-0559-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[stm_lms_courses_grid_display\\\\s+[^\\\\]]*(?:<script|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-0559", "method": "POST", "mode": "block", "severity": 6.4, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<=3.7.11"}, "RULE-CVE-2026-0559-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[stm_lms_courses_grid_display\\\\s+[^\\\\]]*(?:<script|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-0559", "method": "POST", "mode": "block", "severity": 6.4, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<=3.7.11"}, "RULE-CVE-2026-0563-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpgsv_map\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|<script|javascript\\\\s*:|data\\\\s*:[^,]*text/html)~i"}], "cve": "CVE-2026-0563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0563", "description": "WP Google Street View <=1.1.8 Stored XSS via wpgsv_map shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-google-street-view", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-0604-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/template/directory-tree(?:/|\\\\?|&|$)~"}, {"name": "ARGS:dir_path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc(?:[\\\\\\\\/]|$)|[\\\\\\\\/]proc(?:[\\\\\\\\/]|$)|[\\\\\\\\/]var[\\\\\\\\/]log(?:[\\\\\\\\/]|$))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0604", "method": "GET", "mode": "block", "severity": 6.5, "slug": "fastdup", "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2026-0608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:metakeyselect", "type": "equals", "value": "head-meta-data"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-0608", "method": "POST", "mode": "block", "severity": 6.4, "slug": "head-meta-data", "target": "plugin", "versions": "<=20251118"}, "RULE-CVE-2026-0608-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:metakeyinput", "type": "equals", "value": "head-meta-data"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-0608", "method": "POST", "mode": "block", "severity": 6.4, "slug": "head-meta-data", "target": "plugin", "versions": "<=20251118"}, "RULE-CVE-2026-0609-01": {"action": "init", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[logo-slider[\\\\s\\\\]]~i"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~(?:on(?:error|load|click|mouseover)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-0609", "description": "Logo Slider WP <=4.9.0 stored XSS via shortcode image alt attribute", "mode": "block", "severity": 6.4, "slug": "logo-slider-wp", "target": "plugin", "versions": "<=4.9.0"}, "RULE-CVE-2026-0617-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "customer_cabinet__update"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|base|form|input|details|video|audio|meta)\\\\b|<[^>]*\\\\bon(?:error|load|click|mouseover|focus(?:in)?|blur|submit|change|input|keydown|keyup|contextmenu|dblclick|drag|drop|mousedown|mouseup|pointerdown|begin|end|toggle|animationend)\\\\s*=~i"}], "cve": "CVE-2026-0617", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0617", "description": "LatePoint <= 5.2.5 unauthenticated stored XSS via customer profile fields in the customer_cabinet__update route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "latepoint", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=5.2.5"}, "RULE-CVE-2026-0627-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:async-upload\\\\.php|media-new\\\\.php|admin-ajax\\\\.php)~"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0627", "description": "AMP for WP <=1.1.10 Stored XSS via SVG upload \\u2013 best-effort filename gate (blocks all SVG uploads on vulnerable versions; engine cannot inspect file content)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accelerated-mobile-pages", "tags": ["xss", "stored-xss", "svg-upload", "file-upload", "best-effort"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2026-0635-01": {"ajax_action": "accordion_slider_save_images", "conditions": [{"name": "ARGS:gallery", "type": "exists"}, {"name": "ARGS:images", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0635", "description": "Responsive Accordion Slider <=1.2.2 missing authorization via accordion_slider_save_images allows authenticated (Contributor+) users to modify arbitrary slider post metadata", "mode": "block", "severity": 4.3, "slug": "responsive-accordion-slider", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-0656-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^Ipaymu_WC_Gateway$~"}, {"name": "ARGS:id_order", "type": "exists"}, {"name": "ARGS:status", "type": "exists"}], "cve": "CVE-2026-0656", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0656-02": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^Ipaymu_WC_Gateway$~"}, {"name": "ARGS:id_order", "type": "exists"}], "cve": "CVE-2026-0656", "method": "GET", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0656-03": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^WC_Gateway_Ipaymu$~"}, {"name": "ARGS:id_order", "type": "exists"}, {"name": "ARGS:status", "type": "exists"}], "cve": "CVE-2026-0656", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0656-04": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^WC_Gateway_Ipaymu$~"}, {"name": "ARGS:id_order", "type": "exists"}], "cve": "CVE-2026-0656", "method": "GET", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0677-01": {"ajax_action": "totalcontest", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-0677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0677", "description": "TotalContest Lite <=2.9.1 PHP object injection via totalcontest general router AJAX handler (wp_ajax_totalcontest / wp_ajax_nopriv_totalcontest)", "mode": "block", "severity": 7.2, "slug": "totalcontest-lite", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2026-0679-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-api=WC_Gateway_Fortis_Notify(?:&|$)~i"}, {"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-0679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0679", "description": "Fortis for WooCommerce <=1.2.0 unauthenticated order status update via inverted nonce check \\u2014 blocks POST with transaction data payload to the Fortis notify wc-api callback when user lacks manage_woocommerce", "mode": "block", "severity": 5.3, "slug": "fortis-for-woocommerce", "tags": ["missing-authorization", "authentication-bypass", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-0681-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:random_number_generator_format", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*[\\\\s/](?:on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mousemove|dblclick|contextmenu|input|invalid|reset|search|drag|drop|copy|cut|paste|beforeunload|unload|hashchange|message|scroll|wheel|animationend|animationiteration|animationstart|transitionend|pointerdown|pointerup|pointermove|afterprint|beforeprint)\\\\s*=)|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0681", "description": "Extended Random Number Generator <= 1.1 Stored XSS via plugin settings (random_number_generator_format)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "extended-random-number-generator", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-0681-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:random_number_generator_shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*[\\\\s/](?:on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mousemove|dblclick|contextmenu|input|invalid|reset|search|drag|drop|copy|cut|paste|beforeunload|unload|hashchange|message|scroll|wheel|animationend|animationiteration|animationstart|transitionend|pointerdown|pointerup|pointermove|afterprint|beforeprint)\\\\s*=)|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0681", "description": "Extended Random Number Generator <= 1.1 Stored XSS via plugin settings (random_number_generator_shortcode)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "extended-random-number-generator", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-0681-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:random_number_generator_parent_menu", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*[\\\\s/](?:on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mousemove|dblclick|contextmenu|input|invalid|reset|search|drag|drop|copy|cut|paste|beforeunload|unload|hashchange|message|scroll|wheel|animationend|animationiteration|animationstart|transitionend|pointerdown|pointerup|pointermove|afterprint|beforeprint)\\\\s*=)|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0681", "description": "Extended Random Number Generator <= 1.1 Stored XSS via plugin settings (random_number_generator_parent_menu)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "extended-random-number-generator", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-0683-01": {"ajax_action": "wpsc_get_tickets", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:[\'\\")\\\\]]\\\\s*(?:OR|AND|UNION|HAVING)\\\\s)|(?:UNION[\\\\s/\\\\*]+(?:ALL\\\\s+)?SELECT)|(?:SELECT[\\\\s/\\\\*]+(?:[\\\\w*,\\\\s]+)?FROM)|(?:CONCAT\\\\s*\\\\()|(?:GROUP\\\\s+BY.+\\\\()|(?:SLEEP\\\\s*\\\\()|(?:BENCHMARK\\\\s*\\\\()|(?:(?:0x[\\\\da-f]+|X\'[\\\\da-f]+\'|B\'[01]+\'|\'[^\']*\')\\\\s*(?:OR|AND|XOR)\\\\s))~i"}], "cve": "CVE-2026-0683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0683", "description": "SupportCandy <=3.4.4 authenticated SQL injection via Number-type custom field filter operand in wpsc_get_tickets AJAX handler", "mode": "block", "severity": 6.5, "slug": "supportcandy", "tags": ["sql-injection", "authenticated", "custom-field-filter"], "target": "plugin", "versions": "<=3.4.4"}, "RULE-CVE-2026-0684-01": {"action": "admin_init", "conditions": [{"name": "ARGS:cpis_import", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0684", "description": "CP Image Store <=1.1.9 incorrect authorization on importer allows subscriber+ to import products via flawed boolean logic", "method": "POST", "mode": "block", "severity": 4.3, "slug": "cp-image-store", "tags": ["incorrect-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0686-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/webmention/1\\\\.0/endpoint(?:[/?]|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~^(?:https?://(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|0x[0-9a-fA-F]|\\\\[?::(?:ffff:)?|localhost|metadata\\\\.google|169\\\\.254\\\\.|2130706433|2886729728|2851995648)|(?:file|gopher|dict)://)~i"}], "cve": "CVE-2026-0686", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0686", "description": "Webmention <=5.6.2 unauthenticated blind SSRF via source parameter on REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "webmention", "tags": ["ssrf", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2026-0688-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/webmention/1\\\\.0/tools(?:[/?&]|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~(?:^https?://(?:127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?|localhost)(?:[:/]|$)|^(?!https?://)\\\\w+://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0688", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0688", "description": "Webmention <=5.6.2 authenticated (Subscriber+) SSRF via source parameter in Tools::read REST endpoint", "mode": "block", "severity": 6.4, "slug": "webmention", "tags": ["ssrf", "missing-authorization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2026-0692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|[?&])wc-api=bluesnap(?:$|&)~i"}, {"name": "REQUEST_HEADERS:User-Agent", "type": "equals", "value": "BlueSnap"}, {"name": "ARGS:transactionType", "type": "regex", "value": "~^(?:CHARGE|REFUND|DECLINE|RECURRING_PAYMENT_SKIPPED)$~"}, {"name": "ARGS:merchantTransactionId", "type": "exists"}, {"name": "ARGS:referenceNumber", "type": "exists"}, {"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "exists"}], "cve": "CVE-2026-0692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0692", "description": "BlueSnap Payment Gateway for WooCommerce <=3.4.0 unauthenticated IPN webhook authorization bypass via spoofed BlueSnap headers", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bluesnap-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "ip-spoofing", "unauthenticated", "webhook-bypass", "business-logic"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2026-0693-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:description", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|<[^>]+[\\\\s/]on[a-z0-9_-]+\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0693", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0693", "description": "Allow HTML in Category Descriptions <=1.2.4 authenticated stored XSS via category description in edit-tags.php", "method": "POST", "mode": "block", "severity": 4.4, "slug": "allow-html-in-category-descriptions", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=1.2.4"}, "RULE-CVE-2026-0693-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "add-tag"}, {"name": "ARGS:description", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|<[^>]+[\\\\s/]on[a-z0-9_-]+\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0693", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0693", "description": "Allow HTML in Category Descriptions <=1.2.4 authenticated stored XSS via category description in AJAX add-tag", "method": "POST", "mode": "block", "severity": 4.4, "slug": "allow-html-in-category-descriptions", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=1.2.4"}, "RULE-CVE-2026-0694-01": {"ajax_action": "searchwiz_ajax_load_posts_json", "cve": "CVE-2026-0694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0694", "description": "SearchWiz <=1.0.0 stored XSS via unauthenticated search JSON endpoint (html_entity_decode on post title)", "mode": "block", "severity": 6.4, "slug": "searchwiz", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-0694-02": {"ajax_action": "searchwiz_ajax_load_posts", "cve": "CVE-2026-0694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0694", "description": "SearchWiz <=1.0.0 stored XSS via unauthenticated legacy HTML search endpoint (esc_attr instead of esc_html)", "mode": "block", "severity": 6.4, "slug": "searchwiz", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-0702-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vsfw/v1/videos(/|\\\\?|&|$)~"}, {"name": "ARGS:fields", "type": "detectSQLi"}], "cve": "CVE-2026-0702", "method": "GET", "mode": "block", "severity": 7.5, "slug": "vidshop-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-0702-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vsfw/v1/videos(/|\\\\?|&|$)~"}, {"name": "ARGS:ids", "type": "detectSQLi"}], "cve": "CVE-2026-0702", "method": "GET", "mode": "block", "severity": 7.5, "slug": "vidshop-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-0718-01": {"ajax_action": "ultp_share_count", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"name": "ARGS:share_count", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-0718", "description": "PostX <=5.0.5 unauthenticated arbitrary post meta modification via ultp_share_count AJAX handler", "mode": "block", "severity": 5.3, "slug": "ultimate-post", "target": "plugin", "versions": "<=5.0.5"}, "RULE-CVE-2026-0722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/admin-ajax.php"}, {"name": "ARGS:search[value]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|U[Nn]\\\\s*/\\\\*|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|extractvalue\\\\s*\\\\(|updatexml\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-0722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0722", "description": "Shield Security <=21.0.9 CSRF to SQL Injection via search[value] parameter in traffic table DataTables endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-simple-firewall", "tags": ["sql-injection", "csrf", "datatables"], "target": "plugin", "versions": "<=21.0.9"}, "RULE-CVE-2026-0722-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/admin-ajax.php"}, {"name": "ARGS:order[0][column]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|U[Nn]\\\\s*/\\\\*|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|extractvalue\\\\s*\\\\(|updatexml\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-0722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0722", "description": "Shield Security <=21.0.9 CSRF to SQL Injection via order[0][column] parameter in traffic table DataTables endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-simple-firewall", "tags": ["sql-injection", "csrf", "datatables"], "target": "plugin", "versions": "<=21.0.9"}, "RULE-CVE-2026-0726-01": {"ajax_action": "nxt_replace_url", "conditions": [{"name": "ARGS", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2026-0726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0726", "description": "Nexter Extension <=4.4.6 unauthenticated PHP Object Injection via nxt_replace_url AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "nexter-extension", "tags": ["object-injection", "deserialization", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-0726-02": {"ajax_action": "nxt_replace_confirm_url", "conditions": [{"name": "ARGS", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2026-0726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0726", "description": "Nexter Extension <=4.4.6 unauthenticated PHP Object Injection via nxt_replace_confirm_url AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "nexter-extension", "tags": ["object-injection", "deserialization", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-0727-01": {"ajax_action": "wp_aas_get_attachment_edit_form", "conditions": [{"name": "ARGS:attachment_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-0727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0727", "description": "Accordion and Accordion Slider <=1.4.5 missing authorization on wp_aas_get_attachment_edit_form AJAX allowing authenticated users to read any attachment metadata", "method": "POST", "mode": "block", "severity": 5.4, "slug": "accordion-and-accordion-slider", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-0727-02": {"ajax_action": "wp_aas_save_attachment_data", "conditions": [{"name": "ARGS:attachment_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "ARGS:form_data", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-0727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0727", "description": "Accordion and Accordion Slider <=1.4.5 missing authorization on wp_aas_save_attachment_data AJAX allowing authenticated users to modify any attachment metadata", "method": "POST", "mode": "block", "severity": 5.4, "slug": "accordion-and-accordion-slider", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-0736-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:_inpost_head_script", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<embed[^>]*>|<object[^>]*>~i"}, {"name": "ARGS:_inpost_head_script[synth_header_script]", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<embed[^>]*>|<object[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0736", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0736", "description": "Chatbot for WordPress by Collect.chat <=2.4.8 Stored XSS via _inpost_head_script post meta field (missing unfiltered_html capability check)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "collectchat", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-0740-01": {"ajax_action": "nf_fu_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2026-0740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0740", "description": "Unauthenticated arbitrary file upload in Ninja Forms - File Uploads premium plugin <= 3.3.26. The handle_upload AJAX endpoint (nf_fu_upload, registered for wp_ajax_nopriv_) reads an attacker-controlled POST parameter (named after the source filename with dots/spaces converted to underscores) and uses it as the destination filename in NF_FU_AJAX_Controllers_Uploads::_process(), bypassing _validate()\'s extension blacklist. Path traversal variant: attacker writes ../path in the destination POST param to write the file outside the upload directory.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms-uploads", "tags": ["rce", "file-upload", "ninja-forms", "unauthenticated"], "target": "plugin", "versions": "<=3.3.26"}, "RULE-CVE-2026-0740-02": {"ajax_action": "nf_fu_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht)(?:$|[.\\\\s/\\\\x00])~i"}], "cve": "CVE-2026-0740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0740", "description": "Unauthenticated arbitrary file upload in Ninja Forms - File Uploads premium plugin <= 3.3.26. PHP-executable extension variant: attacker writes a value ending in .php / .phtml / .phar / .pht in the destination filename POST parameter (named after the source filename with dots/spaces converted to underscores), causing _process() to write the file with that extension regardless of what _validate() approved on the source name.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms-uploads", "tags": ["rce", "file-upload", "ninja-forms", "unauthenticated"], "target": "plugin", "versions": "<=3.3.26"}, "RULE-CVE-2026-0740-03": {"ajax_action": "nf_fu_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~%252[Ee]%252[Ee]%25(?:2[Ff]|5[Cc])~"}], "cve": "CVE-2026-0740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0740", "description": "Unauthenticated arbitrary file upload in Ninja Forms - File Uploads premium plugin <= 3.3.26. Double-URL-encoded path traversal variant: attacker uses %252E%252E%252F (double-encoded ../) in the destination POST parameter to evade single-decode WAF inspection while the application decodes twice, writing the uploaded file outside the intended upload directory.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms-uploads", "tags": ["rce", "file-upload", "ninja-forms", "unauthenticated"], "target": "plugin", "versions": "<=3.3.26"}, "RULE-CVE-2026-0741-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/options.php"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^esdc_(options_group|file_types)$~"}, {"name": "ARGS:esdc_file_types", "type": "detectXSS"}], "cve": "CVE-2026-0741", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0741", "description": "Electric Studio Download Counter <=2.4 Authenticated (Administrator+) Stored XSS via esdc_file_types settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "electric-studio-download-counter", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2026-0741-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "esdc_options_group"}, {"name": "ARGS:esdc_blocked_ips", "type": "detectXSS"}], "cve": "CVE-2026-0741", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0741", "description": "Electric Studio Download Counter <=2.4 Authenticated (Administrator+) Stored XSS via esdc_blocked_ips settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "electric-studio-download-counter", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2026-0742-01": {"ajax_action": "saab_save_form_data", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0742", "description": "Smart Appointment & Booking <=1.0.7 authenticated stored XSS via saab_save_form_data AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smart-appointment-booking", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-0742-02": {"ajax_action": "saab_save_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=~i"}], "cve": "CVE-2026-0742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0742", "description": "Smart Appointment & Booking <=1.0.7 unauthenticated stored XSS via saab_save_form_submission AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smart-appointment-booking", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-0746-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleTranscribeAudio(?:/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:(?:https?|ftp)://(?:127\\\\.|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(1[6-9]|2\\\\d|3[0-1])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|::1|fd[0-9a-f]{2}:)|file://|gopher://|dict://|php://|data:|zlib://|glob://|phar://|ssh2?:|s?ftp://|imap://|pop3://|smtp://|127\\\\.|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(1[6-9]|2\\\\d|3[0-1])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|::1|fd[0-9a-f]{2}:)~i"}], "cve": "CVE-2026-0746", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-engine", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-0751-01": {"action": "init", "conditions": [{"name": "ARGS:pricing_plan_select_text_font_family", "type": "regex", "value": "~(<[a-zA-Z]|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:|on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2026-0751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0751", "description": "Payment Page <=1.4.6 Stored XSS via pricing_plan_select_text_font_family parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "payment-page", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2026-0753-01": {"action": "init", "conditions": [{"name": "ARGS:sscf_name", "type": "detectXSS"}], "cve": "CVE-2026-0753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0753", "description": "Super Simple Contact Form <=1.6.2 Reflected Cross-Site Scripting via sscf_name parameter", "mode": "block", "severity": 7.2, "slug": "super-simple-contact-form", "tags": ["xss", "reflected-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2026-0806-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-clanwars-teams"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:[`\'\\";]|UNION|SELECT|SLEEP|BENCHMARK|IF\\\\s*[(]|CASE\\\\s+WHEN|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|/[*]|--\\\\s)~i"}], "cve": "CVE-2026-0806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0806", "description": "WP-ClanWars <=2.0.1 authenticated SQL Injection via orderby parameter on Teams admin page", "mode": "block", "severity": 4.9, "slug": "wp-clanwars", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-0807-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/template-proxy/|[?&](?:frontis_)?template_proxy=)~i"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0807", "description": "Frontis Blocks <=1.1.6 unauthenticated SSRF via template-proxy endpoint url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "frontis-blocks", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-0807-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/custom/v1/proxy-image(/|\\\\?|&|$)~"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0807", "description": "Frontis Blocks <=1.1.6 authenticated SSRF via proxy-image REST endpoint url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "frontis-blocks", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-0811-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cf7-details~"}, {"name": "ARGS:del_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0811", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0811", "description": "Advanced CF7 DB <=2.0.9 CSRF allows unauthorized deletion/modification via missing nonce on vsz_cf7_save_setting_callback", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-cf7-db", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-0812-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "linkedin_sc"}, {"name": "ARGS:linkedin_sc_date_format", "type": "detectXSS"}], "cve": "CVE-2026-0812", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0812", "description": "LinkedIn SC <=1.1.9 authenticated (Administrator+) stored XSS via linkedin_sc_date_format settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "linkedin-sc", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0812-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "linkedin_sc"}, {"name": "ARGS:linkedin_sc_api_key", "type": "detectXSS"}], "cve": "CVE-2026-0812", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0812", "description": "LinkedIn SC <=1.1.9 authenticated (Administrator+) stored XSS via linkedin_sc_api_key settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "linkedin-sc", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0812-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "linkedin_sc"}, {"name": "ARGS:linkedin_sc_secret_key", "type": "detectXSS"}], "cve": "CVE-2026-0812", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0812", "description": "LinkedIn SC <=1.1.9 authenticated (Administrator+) stored XSS via linkedin_sc_secret_key settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "linkedin-sc", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0813-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "short_link_options"}, {"name": "ARGS:short_link_post_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-0813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0813", "description": "Short Link <=1.0 administrator+ stored XSS via short_link_post_title settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "short-link", "tags": ["xss", "stored", "settings-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-0813-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "short_link_options"}, {"name": "ARGS:short_link_page_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-0813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0813", "description": "Short Link <=1.0 administrator+ stored XSS via short_link_page_title settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "short-link", "tags": ["xss", "stored", "settings-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-0815-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:tag-image", "type": "regex", "value": "~(?:<script[\\\\s/>]|<(?:img|svg|iframe|object|embed|body|details|math)\\\\b[^>]*\\\\bon[a-z]+=|\\\\bon(?:error|load|mouseover|click|focus|blur|input|change|animationend|transitionend)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0815", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0815", "description": "Category Image <=2.0 authenticated (Editor+) stored XSS via tag-image parameter on term edit/create", "method": "POST", "mode": "block", "severity": 4.4, "slug": "category-image", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-0816-01": {"action": "admin_init", "conditions": [{"name": "ARGS:delete_id", "type": "detectSQLi"}], "cve": "CVE-2026-0816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0816", "description": "All Push Notification for WP <=1.5.3 authenticated SQL injection via delete_id in process_bulk_action", "mode": "block", "severity": 4.9, "slug": "all-push-notification", "tags": ["sql-injection", "authenticated", "admin-only"], "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2026-0825-01": {"action": "init", "conditions": [{"name": "ARGS:vx_crm_form_action", "type": "equals", "value": "download_csv"}, {"name": "ARGS:vx_crm_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0825", "description": "Database for Contact Form 7, WPforms, Elementor forms <=1.4.5 unauthenticated CSV export data exfiltration via missing authorization", "mode": "block", "severity": 5.3, "slug": "contact-form-entries", "tags": ["missing-authorization", "data-exfiltration", "unauthenticated"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-0829-01": {"ajax_action": "wpfm_send_file_in_email", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-0829", "method": "POST", "mode": "block", "severity": 5.8, "slug": "nmedia-user-file-uploader", "target": "plugin", "versions": "<23.6"}, "RULE-CVE-2026-0831-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:session_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in session_id on templately_pack_import AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:content_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in content_id on templately_pack_import AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:session_id", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in session_id targeting sensitive files", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:content_id", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in content_id targeting sensitive files", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:session_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated access to templately_pack_* AJAX handlers missing authorization", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["missing-authorization", "incorrect-authorization", "unauthenticated", "arbitrary-file-write"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0832-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/connect-app(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/user-approve(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/user-deny(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/get-user-details(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/get-all-requests(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/get-dashboard-data(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0833-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via javascript: URI in post content containing team-section block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~on\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via event handler injection in post content containing team-section block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~data\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via data: URI in post content containing team-section block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via javascript: URI in post content containing team-section block (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~on\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via event handler injection in post content containing team-section block (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~data\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via data: URI in post content containing team-section block (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0845-01": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:controller", "type": "equals", "value": "wcfm-settings"}, {"name": "ARGS:wcfm_settings_form", "type": "regex", "value": "~wcfm_page_options(?:%5[Bb]|\\\\[)(?!(?:wc_frontend_manager_page_id|wcfm_vendor_membership_page_id|wcfm_vendor_registration_page_id|wcfm_affiliate_registration_page_id)(?:%5[Dd]|\\\\]))~"}], "cve": "CVE-2026-0845", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wc-frontend-manager", "target": "plugin", "versions": "<=6.7.24"}, "RULE-CVE-2026-0867-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php$~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ew-(author|archive|category|page|menu)\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|toggle|mouseover|focus|blur)\\\\s*=|javascript:|<iframe|<embed|<object|<svg[^>]*on[a-zA-Z0-9_]+\\\\s*=|<img[^>]*on[a-zA-Z0-9_]+\\\\s*=)~i"}], "cve": "CVE-2026-0867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0867", "description": "Essential Widgets <=3.0 Authenticated (Contributor+) Stored XSS via ew-page, ew-author, ew-archive, ew-category, ew-menu shortcodes in post content (wp-admin)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-widgets", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-0867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ew-(author|archive|category|page|menu)\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|toggle|mouseover|focus|blur)\\\\s*=|javascript:|<iframe|<embed|<object|<svg[^>]*on[a-zA-Z0-9_]+\\\\s*=|<img[^>]*on[a-zA-Z0-9_]+\\\\s*=)~i"}], "cve": "CVE-2026-0867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0867", "description": "Essential Widgets <=3.0 Authenticated (Contributor+) Stored XSS via ew-page, ew-author, ew-archive, ew-category, ew-menu shortcodes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-widgets", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-0909-01": {"ajax_action": "wp_ulike_delete_history_api", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0909", "description": "WP ULike <=4.8.3.1 Insecure Direct Object Reference allowing authenticated users to delete arbitrary log entries via wp_ulike_delete_history_api AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-ulike", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.8.3.1"}, "RULE-CVE-2026-0910-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpforo-tools"}, {"name": "ARGS:wpfu", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0910", "description": "wpForo Forum <=2.4.13 authenticated PHP Object Injection via maybe_unserialize in wpforo_display_array_data on debug tools page", "mode": "block", "severity": 8.8, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.13"}, "RULE-CVE-2026-0911-01": {"ajax_action": "hustle_module_handle_single_action", "conditions": [{"name": "FILES:import_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0911", "method": "POST", "mode": "block", "slug": "wordpress-popup", "target": "plugin", "versions": "<=7.8.9.2"}, "RULE-CVE-2026-0912-01": {"ajax_action": "trman_save_option", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0912", "description": "Toret Manager <=1.2.7 missing authorization on trman_save_option allows authenticated privilege escalation", "mode": "block", "severity": 8.8, "slug": "toret-manager", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-0912-02": {"ajax_action": "trman_save_option_items", "conditions": [{"name": "ARGS:name", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0912", "description": "Toret Manager <=1.2.7 missing authorization on trman_save_option_items allows authenticated privilege escalation", "mode": "block", "severity": 8.8, "slug": "toret-manager", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-0916-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[related_posts_by_tax[ \\\\t][^\\\\]]*(?:<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 Stored XSS via related_posts_by_tax shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0916-03": {"ajax_action": "rpbt_lazy_loading", "conditions": [{"name": "ARGS:rpbt_args[title]", "type": "regex", "value": "~<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object~i"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 XSS via rpbt_lazy_loading AJAX handler rpbt_args[title]", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "ajax"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0916-04": {"ajax_action": "rpbt_lazy_loading", "conditions": [{"name": "ARGS:rpbt_args[before_title]", "type": "regex", "value": "~<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object~i"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 XSS via rpbt_lazy_loading AJAX handler rpbt_args[before_title]", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "ajax"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0916-05": {"ajax_action": "rpbt_lazy_loading", "conditions": [{"name": "ARGS:rpbt_args[after_title]", "type": "regex", "value": "~<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object~i"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 XSS via rpbt_lazy_loading AJAX handler rpbt_args[after_title]", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "ajax"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0920-01": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS:lakit_bkrole", "type": "regex", "value": "~(?:administrator|editor|author)~i"}], "cve": "CVE-2026-0920", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.5.6.3"}, "RULE-CVE-2026-0920-02": {"action": "init", "conditions": [{"name": "ARGS:lakit_bkrole", "type": "regex", "value": "~(?:administrator|editor|author)~i"}, {"name": "ARGS:email", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-0920", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.5.6.3"}, "RULE-CVE-2026-0939-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/redeIntegration/maxipagoDebitListener(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0939", "description": "Rede Ita\\u00fa for WooCommerce <=5.1.2 unauthenticated order status manipulation via forged Maxipago debit webhook on /redeIntegration/maxipagoDebitListener", "method": "POST", "mode": "block", "severity": 5.3, "slug": "woo-rede", "tags": ["insufficient-verification", "forged-webhook", "unauthenticated", "order-manipulation"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-0939-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/woorede/s(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0939", "description": "Rede Ita\\u00fa for WooCommerce <=5.1.2 unauthenticated order status manipulation via forged 3DS success callback on /woorede/s", "method": "POST", "mode": "block", "severity": 5.3, "slug": "woo-rede", "tags": ["insufficient-verification", "forged-webhook", "unauthenticated", "order-manipulation"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-0939-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/woorede/f(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0939", "description": "Rede Ita\\u00fa for WooCommerce <=5.1.2 unauthenticated order status manipulation via forged 3DS failure callback on /woorede/f", "method": "POST", "mode": "block", "severity": 5.3, "slug": "woo-rede", "tags": ["insufficient-verification", "forged-webhook", "unauthenticated", "order-manipulation"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-0950-01": {"ajax_action": "ast_block_templates_import_wpforms", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0950", "description": "Spectra (UAG) <= 2.19.17 broken access control on WPForms template import via ast_block_templates_import_wpforms", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ultimate-addons-for-gutenberg", "tags": ["bac", "template-import"], "target": "plugin", "versions": "<=2.19.17"}, "RULE-CVE-2026-0974-01": {"ajax_action": "iconic_onboard_orderable_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-0974", "method": "POST", "mode": "block", "severity": 8.8, "slug": "orderable", "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2026-0996-01": {"ajax_action": "fluentform_ai_create_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0996", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.1.14"}, "RULE-CVE-2026-1000-01": {"ajax_action": "woo_mailerlite_reset_integration_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1000", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woo-mailerlite", "target": "plugin", "versions": "<3.1.4"}, "RULE-CVE-2026-1003-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/getgenie/v1/geniechat/[\\\\w-]+~"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2026-1003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1003", "description": "GetGenie <=4.3.0 missing authorization (IDOR) allows Author+ arbitrary post deletion via geniechat REST endpoint", "mode": "block", "severity": 4.3, "slug": "getgenie", "tags": ["missing-authorization", "idor", "arbitrary-post-deletion", "rest-api"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2026-1004-02": {"ajax_action": "eael_product_quickview_popup", "conditions": [{"name": "ARGS:product_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-1004", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1004", "description": "Essential Addons for Elementor <=6.5.5 unauthenticated sensitive product information exposure via eael_product_quickview_popup AJAX action (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "essential-addons-for-elementor-lite", "tags": ["missing-authorization", "sensitive-data-exposure", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2026-10091-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[email\\\\s[^\\\\]]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-10091", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10091", "description": "Email JavaScript Cloak <=1.03 stored XSS via [email] shortcode in post_content (classic editor)", "mode": "block", "severity": 7.2, "slug": "email-javascript-cloaker", "tags": ["xss", "stored-xss", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.03"}, "RULE-CVE-2026-10091-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[email\\\\s[^\\\\]]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-10091", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10091", "description": "Email JavaScript Cloak <=1.03 stored XSS via [email] shortcode in content field (REST API wp/v2/posts)", "mode": "block", "severity": 7.2, "slug": "email-javascript-cloaker", "tags": ["xss", "stored-xss", "authenticated", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.03"}, "RULE-CVE-2026-10092-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[cincopa\\\\b[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*i(?:mg|frame)\\\\b[^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-10092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10092", "description": "Cincopa Video and Media Plugin <=1.163 unauthenticated stored XSS via [cincopa] shortcode in post comments", "mode": "block", "severity": 7.2, "slug": "video-playlist-and-gallery-plugin", "tags": ["xss", "stored", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.163"}, "RULE-CVE-2026-1032-01": {"action": "admin_init", "conditions": [{"name": "ARGS:themify_cm", "type": "exists"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-1032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1032", "description": "Conditional Menus <=1.2.6 Cross-Site Request Forgery via themify_cm parameter in save_options", "method": "POST", "mode": "block", "severity": 4.3, "slug": "conditional-menus", "tags": ["csrf", "missing-nonce", "options-update"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-1036-01": {"ajax_action": "GalleryBox", "conditions": [{"name": "ARGS:ajax_task", "type": "regex", "value": "~^delete_comment$~i"}, {"name": "ARGS:id_comment", "type": "exists"}], "cve": "CVE-2026-1036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1036", "description": "Photo Gallery by 10Web <=1.8.36 missing authorization on delete_comment via GalleryBox AJAX", "mode": "block", "severity": 5.3, "slug": "photo-gallery", "tags": ["missing-authorization", "arbitrary-comment-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.8.36"}, "RULE-CVE-2026-1042-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:digit_one", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1042", "description": "WP Hello Bar <=1.02 authenticated stored XSS via digit_one settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-hello-bar", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=1.02"}, "RULE-CVE-2026-1042-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:digit_two", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1042", "description": "WP Hello Bar <=1.02 authenticated stored XSS via digit_two settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-hello-bar", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=1.02"}, "RULE-CVE-2026-10522-01": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wpr[wp_field][role]", "type": "exists"}], "cve": "CVE-2026-10522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10522", "description": "MemberHero / Simple User Registration (wp-registration) <=6.8 unauthenticated privilege escalation. The wpr_submit_form AJAX handler (registered for both wp_ajax_ and wp_ajax_nopriv_, wp-registration.php:127-128) passes the attacker-controlled wpr[wp_field] array straight into wp_insert_user() (class.register.php:49 in 6.8, :52 in 6.9), and WP core honours userdata[\'role\'] at wp-includes/user.php:2664, so wpr[wp_field][role]=administrator creates an administrator account from an unauthenticated POST. 6.9 unsets this key at class.register.php:39.", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization", "user-registration"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2026-10522-02": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wpr[wp_field][roles]", "type": "exists"}], "cve": "CVE-2026-10522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10522", "description": "MemberHero / Simple User Registration (wp-registration) <=6.8 unauthenticated privilege escalation via the wpr[wp_field][roles] key. One of the four privilege keys the 6.9 patch unsets at class.register.php:39 before wp_insert_user(); on <=6.8 it reaches the sink (:49) unfiltered. The plugin\'s own form builder cannot map a field to this key (class.field.php meta_wp_fields() offers only user_login/first_name/last_name/user_email/ password/url/nickname/display_name/jabber/aim/yim/description), so it is never benign.", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization", "user-registration"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2026-10522-03": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wpr[wp_field][wp_capabilities]", "type": "exists"}], "cve": "CVE-2026-10522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10522", "description": "MemberHero / Simple User Registration (wp-registration) <=6.8 unauthenticated privilege escalation via the wpr[wp_field][wp_capabilities] key -- the serialized WordPress capability map. One of the four privilege keys the 6.9 patch unsets at class.register.php:39; on <=6.8 the attacker-controlled wp_field array reaches wp_insert_user() at :49 with this key intact.", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization", "user-registration"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2026-10522-04": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wpr[wp_field][user_level]", "type": "exists"}], "cve": "CVE-2026-10522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10522", "description": "MemberHero / Simple User Registration (wp-registration) <=6.8 unauthenticated privilege escalation via the legacy wpr[wp_field][user_level] key. One of the four privilege keys the 6.9 patch unsets at class.register.php:39; on <=6.8 it reaches wp_insert_user() at :49 unfiltered.", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization", "user-registration"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2026-10522-05": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wpr[wp_field][ID]", "type": "exists"}], "cve": "CVE-2026-10522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10522", "description": "MemberHero / Simple User Registration (wp-registration) <=6.9 unauthenticated existing account takeover. A non-empty wpr[wp_field][ID] switches wp_insert_user() to UPDATE mode on that account (WP core user.php:2275) -- administrator ID 1 exists on every standard install -- and wpr_hook_set_password (hooks.php:87-100) always assigns user_pass, so the targeted account\'s password and email are overwritten from an unauthenticated POST. The 6.9 patch unsets only role/roles/wp_capabilities/user_level and leaves ID reachable, which is the residual that keeps 6.9 exploitable.", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["account-takeover", "privilege-escalation", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.9"}, "RULE-CVE-2026-1054-01": {"ajax_action": "rm_set_otp", "conditions": [{"name": "ARGS:otp_type", "type": "equals", "value": "google"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1054", "description": "RegistrationMagic <= 6.0.7.4 broken authentication in OTP verification bypassing email ownership", "method": "POST", "mode": "block", "severity": 5.3, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.7.4"}, "RULE-CVE-2026-1055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:welcomeMessage", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|svg|object|embed)[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1055", "description": "TalkJS <=0.1.15 authenticated (Administrator+) stored XSS via welcomeMessage settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "talkjs", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=0.1.15"}, "RULE-CVE-2026-10551-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<!--\\\\s*/?\\\\s*noptimize\\\\s*-->~i"}], "cve": "CVE-2026-10551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10551", "description": "Breeze Cache <2.5.6 unauthenticated stored XSS via injected HTML-minification noptimize exclusion marker", "mode": "block", "severity": 6.1, "slug": "breeze", "tags": ["stored-xss", "unauthenticated", "html-minification"], "target": "plugin", "versions": "<2.5.6"}, "RULE-CVE-2026-1058-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:&lt;|&#0*60;|&#x0*3[cC];)\\\\s*(?:script|img|svg|iframe|object|embed|body|details|video|audio|math|form|input|marquee|a\\\\b)~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-1058-02": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)[\\\\s>]~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-1058-03": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:img|svg|body|details|video|audio|math|marquee|input|a\\\\b)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-10580-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc-hippoo/v1/ext/wp/v2/users(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-10580", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 unauthenticated admin account takeover via cloned REST user endpoint password reset", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-10580-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc-hippoo/v1/ext/(?:/|[a-z])~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-10580", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 unauthenticated access to all cloned REST endpoints via /wc-hippoo/v1/ext/ namespace", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-10586-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/essential-blocks/v1/save_ai_generated_image(?:[/?]|$)~"}, {"name": "ARGS:image_url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh2?)://|(?:^https?://)?(?:(?:127\\\\.)|(?:0\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|localhost(?:$|[:/])|\\\\[?::1\\\\]?(?:$|[:/])|\\\\[?::ffff:)|(?:^https?://|^)0x[0-9a-f]+(?:[:/]|$)|(?:^https?://|^)[0-9]{8,10}(?:[:/]|$))~i"}], "cve": "CVE-2026-10586", "description": "Essential Blocks <=6.1.3 authenticated (Author+) SSRF via image_url in save_ai_generated_image REST endpoint", "mode": "block", "severity": 7.2, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.1.3"}, "RULE-CVE-2026-1060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/adminify/v1/get-addons-list(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1060", "description": "WP Adminify <=4.0.7.7 unauthenticated sensitive information exposure via get-addons-list REST API", "method": "GET", "mode": "block", "severity": 5.3, "slug": "adminify", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.0.7.7"}, "RULE-CVE-2026-1070-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=alex-user-counter~"}, {"name": "ARGS:user_count_info", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1070", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1070", "description": "User Counter <=6.0 CSRF allows attacker to manipulate plugin settings via missing nonce validation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "user-counter", "tags": ["csrf", "cross-site-request-forgery", "missing-authorization"], "target": "plugin", "versions": "<=6.0"}, "RULE-CVE-2026-1071-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_cache_timeout", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_cache_timeout settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_api_timeout", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_api_timeout settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_grace_period_timeout", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_grace_period_timeout settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_google_ads_id", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_google_ads_id settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_google_tagmanager_id", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_google_tagmanager_id settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_special_render_options", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_special_render_options settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_branding", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_branding settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_alternate_subscription_page", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_alternate_subscription_page settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_redirect_page", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_redirect_page settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-12": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_detail_pagename", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_detail_pagename settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1071-13": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^carta-online(?:\\\\b|$)~i"}, {"name": "ARGS:co_detail_redirect_name", "type": "regex", "value": "~(?:<script\\\\b[^>]*>[\\\\s\\\\S]*?</script\\\\s*>|<[^>]+\\\\bon[a-z]{3,}\\\\s*=\\\\s*(?:\\"[^\\"]+\\"|\'[^\']+\'|[^\\\\s>]+)|javascript\\\\s*:[^\\\\s\\"\'<>]+)~i"}], "cve": "CVE-2026-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1071", "description": "Carta Online <=2.13.0 authenticated stored XSS via co_detail_redirect_name settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "carta-online", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2026-1072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options(?:-general)?\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "keybaseverif"}, {"name": "ARGS:keybaseverif_text", "type": "regex", "value": "~(?:<script(?:\\\\s+[a-z][a-z0-9\\\\-]*\\\\s*=|\\\\s*>|/>)|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/][^>]*on[a-z]+=)~i"}], "cve": "CVE-2026-1072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1072", "description": "WP Keybase Verification <=1.4.5 CSRF to stored XSS via keybaseverif_text settings update", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-keybase-verification", "tags": ["csrf", "xss", "stored", "settings-update"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-10737-01": {"ajax_action": "cdm_view_file", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-10737", "description": "SP Project & Document Manager <=4.71 unauthenticated file metadata/download link exposure via cdm_view_file AJAX handler", "mode": "block", "severity": 7.5, "slug": "sp-client-document-manager", "target": "plugin", "versions": "<=4.71"}, "RULE-CVE-2026-1074-01": {"ajax_action": "app_bar_settings", "conditions": [{"name": "ARGS:app-bar-features", "type": "regex", "value": "~(?:<[^>]*(?:script|iframe|object|embed|form|input|textarea|button|details|select|video|audio|source|svg|math|base|link|meta|style|applet)|(?:^|[^a-zA-Z0-9_])on(?:load|error|mouseover|mouseout|click|dblclick|focus|blur|change|submit|keydown|keypress|keyup|cut|copy|paste|abort|resize|scroll|pointerover|animationend)[ ]*=|javascript[ ]*:|data[ ]*:[^,]*;[ ]*base64)~i"}], "cve": "CVE-2026-1074", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1074", "description": "WP App Bar <=1.5 unauthenticated stored XSS via app-bar-features parameter in app_bar_settings AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-app-bar", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2026-1082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "title-animator"}, {"name": "ARGS", "type": "regex", "value": "~(?:<(?:script|svg|iframe|embed|object|details|body)[\\\\s/>]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1082", "description": "Title Animator <=1.0 reflected XSS via unsanitized REQUEST_URI on settings page", "mode": "block", "severity": 4.3, "slug": "title-animator", "tags": ["xss", "reflected", "csrf"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-10833-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/table-of-contents[^}]*\\"configurablePrefix\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-10833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10833", "description": "Essential Blocks <=6.1.4 stored XSS via configurablePrefix block attribute in Table of Contents block", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.4"}, "RULE-CVE-2026-1084-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^cookie[_-]consent[_-](?:for[_-]developers|settings)$~"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|svg|embed|object)[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1084", "description": "Cookie consent for developers <=1.7.1 authenticated (Administrator+) Stored XSS via plugin settings fields on options.php", "method": "POST", "mode": "block", "severity": 4.4, "slug": "cookie-consent-for-developers", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2026-1085-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\?page=seolocalrank~"}, {"name": "ARGS:signout", "type": "contains", "value": "1"}, {"name": "capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1085", "description": "SEO Local Rank <=2.2.9 CSRF allows attackers to disconnect admin accounts via signout parameter", "mode": "block", "severity": 4.3, "slug": "seo-local-rank", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-1095-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "canto_testimonials"}, {"name": "ARGS:post_content", "type": "regex", "value": "~canto_testimonials[^]]*fx *=[^]]*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1095", "description": "Canto Testimonials <=1.0 Stored XSS via shortcode fx attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "canto-testimonials", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[google_map_view\\\\b[^\\\\]]*\\\\b(?:latitude|longitudinal)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on[a-z]+=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1096", "description": "Best-WP Google Map <=2.1 stored XSS via latitude/longitudinal shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "best-wp-google-map", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2026-1097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tmauthors\\\\s[^\\\\]]*(?:before|after|separator)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|toggle|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1097", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1097", "description": "ThemeRuby Multi Authors <=1.0.0 Contributor+ stored XSS via tmauthors shortcode before/after/separator attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeruby-multi-authors", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1098-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[css_columns[^\\\\]]*tag\\\\s*=\\\\s*[\\"\'](?:[^\\"\']*[\\\\s<>][^\\"\']*|(?:script|iframe|object|embed|svg|math|style))[\\"\']~i"}], "cve": "CVE-2026-1098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1098", "description": "CM CSS Columns <=1.2.1 Stored XSS via [css_columns] shortcode tag attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cm-css-columns", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1098-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[css_columns[^\\\\]]*tag\\\\s*=\\\\s*[\\"\'](?:[^\\"\']*[\\\\s<>][^\\"\']*|(?:script|iframe|object|embed|svg|math|style))[\\"\']~i"}], "cve": "CVE-2026-1098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1098", "description": "CM CSS Columns <=1.2.1 Stored XSS via [css_columns] shortcode tag attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cm-css-columns", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1104-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1104", "mode": "block", "severity": 8.8, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-1127-01": {"ajax_action": "timeline_shortcode", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<|>|%3[Cc]|%3[Ee])~"}], "cve": "CVE-2026-1127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1127", "description": "Timeline Event History <=3.2 reflected XSS via id parameter in timeline_shortcode AJAX handler (unauthenticated)", "mode": "block", "severity": 6.1, "slug": "timeline-event-history", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2026-11363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:nf_import_security", "type": "exists"}, {"name": "FILES:nf_import_fields:content", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-11363", "description": "Ninja Forms <=3.14.6 PHP Object Injection via unhardened unserialize() of nf_import_fields upload content in import_fields_listener", "mode": "block", "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.6"}, "RULE-CVE-2026-11395-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~^(?:169\\\\.254\\\\.|127\\\\.0\\\\.0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0(?:x[0-9a-f]+|[0-7]+\\\\.)|\\\\[?::1\\\\]?$|0\\\\.0\\\\.0\\\\.0|localhost)~i"}], "cve": "CVE-2026-11395", "description": "CF7 to Webhook <=5.0.0 unauthenticated SSRF via CF7 field placeholder in webhook URL host segment", "mode": "block", "severity": 7.2, "slug": "cf7-to-zapier", "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2026-11426-01": {"action": "init", "conditions": [{"name": "ARGS:template_thumbnail", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|^(?:/|[A-Za-z]:[\\\\\\\\/])|php://|file://|/etc/passwd|wp-config\\\\.php~i"}], "cve": "CVE-2026-11426", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11426", "description": "UnderConstructionPage PRO <=5.76 arbitrary file read via template_thumbnail (path traversal / arbitrary local file path copied into public uploads); NOTE - evidence gap: analyzed plugin tree resolved to FREE tier under-construction-page 4.05/trunk, not the PRO 5.76/5.81 codebase named by NVD/Wordfence, so no code-level hook/sink/capability confirmation exists for this parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "under-construction-page", "tags": ["path-traversal", "arbitrary-file-read", "authenticated", "low-confidence"], "target": "plugin", "versions": "<=5.76"}, "RULE-CVE-2026-11551-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2026-11551", "description": "Branda <=3.4.29 unauthenticated privilege escalation via account takeover through registration password fields (single-site)", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<=3.4.29"}, "RULE-CVE-2026-11551-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-signup\\\\.php~"}, {"name": "ARGS:signup_password", "type": "exists"}], "cve": "CVE-2026-11551", "description": "Branda <=3.4.29 unauthenticated privilege escalation via multisite signup password fields", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<=3.4.29"}, "RULE-CVE-2026-11571-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/uploads/(?:[^/?]+/)*[^/?]*[0-9]{3,}[^/?]*\\\\.csv(?:\\\\?|$)~i"}], "cve": "CVE-2026-11571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11571", "description": "Everest Forms <3.5.0 unauthenticated disclosure of form submissions via leftover temporary CSV export file in uploads directory", "method": "GET", "mode": "block", "severity": 7.5, "slug": "everest-forms", "tags": ["sensitive-data-exposure", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<3.5.0"}, "RULE-CVE-2026-11589-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "createNewTicket"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:s?html?|svg|xhtml?|xml)$~i"}], "cve": "CVE-2026-11589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11589", "description": "WP Support Plus Responsive Ticket System <=9.1.2 unauthenticated stored XSS via malicious HTML/SVG/HTM file upload in createNewTicket", "mode": "block", "severity": 8.8, "slug": "wp-support-plus-responsive-ticket-system", "tags": ["xss", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-1165-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "equals", "value": "ays_pb_publish_popupbox"}, {"name": "ARGS:popupbox", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF publish popupbox via admin.php action parameter", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1165-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "equals", "value": "ays_pb_unpublish_popupbox"}, {"name": "ARGS:popupbox", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF unpublish popupbox via admin.php action parameter", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1165-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "regex", "value": "~^ays_pb_(?:publish|unpublish)_popupbox$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF bulk publish/unpublish popupbox via POST", "method": "POST", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1187-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[zoomify\\\\s[^\\\\]]*filename\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</script>)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1187", "description": "ZoomifyWP Free <=1.1 Contributor+ Stored XSS via zoomify shortcode filename attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tz-zoomifywp-free", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-11911-01": {"ajax_action": "simplefilelist_edit_job", "conditions": [{"name": "ARGS:eeSubFolder", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee][\\\\\\\\/]|%2[Ee]%2[Ee]%2[Ff]|%252[Ee]%252[Ee])~i"}], "cve": "CVE-2026-11911", "description": "Simple File List <=6.3.7 unauthenticated arbitrary file deletion via path traversal in eeSubFolder parameter", "mode": "block", "severity": 7.5, "slug": "simple-file-list", "target": "plugin", "versions": "<=6.3.7"}, "RULE-CVE-2026-11911-02": {"ajax_action": "simplefilelist_edit_job", "conditions": [{"name": "ARGS:eeFileName", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee][\\\\\\\\/]|%2[Ee]%2[Ee]%2[Ff]|%252[Ee]%252[Ee])~i"}], "cve": "CVE-2026-11911", "description": "Simple File List <=6.3.7 unauthenticated arbitrary file deletion via path traversal in eeFileName parameter", "mode": "block", "severity": 7.5, "slug": "simple-file-list", "target": "plugin", "versions": "<=6.3.7"}, "RULE-CVE-2026-11961-01": {"action": "init", "conditions": [{"name": "ARGS:member_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-11961", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11961", "description": "User Registration & Membership <5.2.3 unauthorized user deletion via member_id in membership AJAX cleanup path", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<5.2.3"}, "RULE-CVE-2026-11962-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:mkfile|rename)$~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp(?:x)?|jsp(?:x)?|cfm)(?:$|[\\"\'\\\\s&])|(?:^|[/\\\\\\\\])\\\\.htaccess(?:$|[\\"\'\\\\s&]))~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 authenticated arbitrary executable file creation through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-02": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "put"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=|[\\\\t\\\\r\\\\n ])~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 authenticated PHP content write through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-03": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "extract"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 unsafe archive extraction through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-04": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "put"}, {"name": "ARGS:encoding", "type": "regex", "value": "~^(?:scheme|hash)$~"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 encoded content write through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11964-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/user-registration/paypal-webhook[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:ur-membership-listener", "type": "exists"}, {"name": "ARGS:ur-membership-return", "type": "exists"}], "cve": "CVE-2026-11964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11964", "description": "User Registration & Membership <5.2.2 unauthenticated forged PayPal webhook activates paid membership without payment", "mode": "block", "severity": 9.1, "slug": "user-registration", "tags": ["missing-authorization", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<5.2.2"}, "RULE-CVE-2026-11964-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/user-registration/paypal-webhook[\\\\\\\\/]*$~i"}, {"name": "ARGS:ur-membership-listener", "type": "exists"}, {"name": "ARGS:ur-membership-return", "type": "exists"}], "cve": "CVE-2026-11964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11964", "description": "User Registration & Membership <5.2.2 unauthenticated forged PayPal webhook activates paid membership without payment", "mode": "block", "severity": 9.1, "slug": "user-registration", "tags": ["missing-authorization", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<5.2.2"}, "RULE-CVE-2026-1206-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "get_template_data"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1206", "description": "Elementor <=3.35.7 contributor+ sensitive information disclosure via get_template_data sub-action on elementor_ajax \\u2014 authorization logic bypass (CWE-639) allows reading private/draft templates", "mode": "block", "severity": 4.3, "slug": "elementor", "tags": ["broken-access-control", "information-disclosure", "idor"], "target": "plugin", "versions": "<=3.35.7"}, "RULE-CVE-2026-1210-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~age[_-]?gate[^}]*(?:desc|footer_text)[^}]*<[^>]*(?:on[a-zA-Z]+=|<script|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1210", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1210", "description": "Happy Addons for Elementor <=3.20.7 Stored XSS via Age Gate widget desc/footer_text fields in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.20.7"}, "RULE-CVE-2026-1210-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~ha_custom_svg[^}]*(?:<script|on[a-zA-Z]+=|javascript:|foreignObject)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1210", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1210", "description": "Happy Addons for Elementor <=3.20.7 Stored XSS via SVG Draw widget ha_custom_svg field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget", "svg-xss"], "target": "plugin", "versions": "<=3.20.7"}, "RULE-CVE-2026-1215-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mma_call_tracking_menu"}, {"name": "ARGS:submit", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1215", "description": "MMA Call Tracking <=2.3.15 CSRF allows unauthorized modification of plugin settings via forged request", "mode": "block", "severity": 4.3, "slug": "mma-call-tracking", "tags": ["csrf", "missing-authorization", "settings-update"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2026-1216-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#[xX]?[0-9])~i"}], "cve": "CVE-2026-1216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1216", "description": "WP RSS Aggregator <=5.0.10 unauthenticated reflected XSS via template parameter in wpra.render.display AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2026-1216-02": {"ajax_action": "wprss_render", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#[xX]?[0-9])~i"}], "cve": "CVE-2026-1216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1216", "description": "WP RSS Aggregator <=5.0.10 unauthenticated reflected XSS via template parameter in legacy wprss_render AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2026-1219-01": {"ajax_action": "load_track_note_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_track_note_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1219-02": {"ajax_action": "load_post_by_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_post_by_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1219-03": {"ajax_action": "load_lyrics_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_lyrics_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-12238-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpgmza/v1/(?:markers|maps|circles|polygons|polylines|rectangles|point-labels)(?:[/?&]|$)~"}, {"name": "ARGS:phpClass", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12238", "description": "WP Go Maps <=10.1.01 unauthenticated arbitrary record creation via phpClass parameter on REST CRUD API", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "target": "plugin", "versions": "<=10.1.01"}, "RULE-CVE-2026-12238-02": {"ajax_action": "wpgmza_rest_api_request", "conditions": [{"name": "ARGS:phpClass", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12238", "description": "WP Go Maps <=10.1.01 unauthenticated arbitrary record creation via phpClass parameter on AJAX fallback endpoint", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "target": "plugin", "versions": "<=10.1.01"}, "RULE-CVE-2026-1231-01": {"action": "wp", "conditions": [{"name": "ARGS:fl_action", "type": "equals", "value": "save_global_settings"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2026-1231", "method": "POST", "mode": "block", "severity": 6.4, "slug": "beaver-builder-lite-version", "target": "plugin", "versions": "<=2.10.0.5"}, "RULE-CVE-2026-1235-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^wpsc_~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;&])O:\\\\d+:\\"[A-Za-z_]~"}], "cve": "CVE-2026-1235", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-e-commerce", "target": "plugin", "versions": "<3.15.2"}, "RULE-CVE-2026-1236-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/envira(?:/[0-9]+)?(?:[/?]|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1236", "description": "Envira Gallery Lite <=1.12.3 stored XSS via justified_gallery_theme parameter in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "envira-gallery-lite", "tags": ["xss", "stored", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.12.3"}, "RULE-CVE-2026-1236-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_eg_gallery_data[config][justified_gallery_theme]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\'][\\\\s]*on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1236", "description": "Envira Gallery Lite <=1.12.3 stored XSS via justified_gallery_theme parameter in post edit form", "method": "POST", "mode": "block", "severity": 6.4, "slug": "envira-gallery-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.12.3"}, "RULE-CVE-2026-1238-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<iframe|<svg|<img[^>]*on[a-z]+\\\\s*=|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-1238", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1238", "description": "WP Slimstat <=5.3.5 unauthenticated stored XSS via slimtrack fh parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.3.5"}, "RULE-CVE-2026-1239-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/token/refresh(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1239", "description": "Ninja Forms <=3.14.1 unauthenticated access to form submissions via ninja-forms-views/token/refresh REST endpoint", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-12407-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "e2pdf-templates"}, {"name": "ARGS:action", "type": "equals", "value": "screen"}, {"name": "ARGS:wp_screen_options[option]", "type": "regex", "value": "~^(?!screen_layout_columns$|metaboxhidden_)~"}, {"type": "missing_capability", "value": "e2pdf_templates"}], "cve": "CVE-2026-12407", "description": "E2Pdf <=1.32.26 authenticated arbitrary option update via screen_action() missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "e2pdf", "target": "plugin", "versions": "<=1.32.26"}, "RULE-CVE-2026-12416-01": {"ajax_action": "pravel_invoice_change_password", "conditions": [{"name": "ARGS:reset_user_id", "type": "exists"}], "cve": "CVE-2026-12416", "description": "Invoice Generator <=1.0.0 unauthenticated account takeover via pravel_invoice_change_password AJAX handler with weak reset code validation", "mode": "block", "severity": 9.8, "slug": "invoice-creator", "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-12417-01": {"ajax_action": "pravel_change_password", "conditions": [{"name": "ARGS:reset_user_id", "type": "exists"}, {"name": "ARGS:new_password_custom", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12417", "description": "SignUp & SignIn <=1.0.0 unauthenticated account takeover via pravel_change_password AJAX handler", "mode": "block", "severity": 9.8, "slug": "signup-signin", "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1244-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[financoop_campaign\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2026-1244", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1244", "description": "Forms Bridge <= 4.2.5 Stored XSS via financoop_campaign shortcode id attribute in post content (wp-admin/post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forms-bridge", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2026-1244-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[financoop_campaign\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2026-1244", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1244", "description": "Forms Bridge <= 4.2.5 Stored XSS via financoop_campaign shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forms-bridge", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2026-1246-01": {"ajax_action": "shortpixel_ajaxRequest", "conditions": [{"name": "ARGS:screen_action", "type": "equals", "value": "loadLogFile"}, {"name": "ARGS:loadFile", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])debug\\\\.log$)~i"}], "cve": "CVE-2026-1246", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1246", "description": "ShortPixel Image Optimizer <=6.4.2 authenticated arbitrary file read via path traversal in loadLogFile AJAX sub-action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "shortpixel-image-optimiser", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2026-12470-01": {"ajax_action": "cmp_ajax_import_settings", "conditions": [{"name": "ARGS:json", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-12470", "description": "CMP - Coming Soon & Maintenance Plugin by NiteoThemes <=4.1.17 missing capability check on cmp_ajax_import_settings AJAX action allows Editor-level privilege escalation via arbitrary option update", "mode": "block", "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=4.1.17"}, "RULE-CVE-2026-1249-01": {"ajax_action": "load_lyrics_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1249", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1249", "description": "MP3 Audio Player by Sonaar <=5.10 authenticated SSRF via load_lyrics_ajax AJAX action", "method": "POST", "mode": "block", "severity": 5.0, "slug": "mp3-music-player-by-sonaar", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.10"}, "RULE-CVE-2026-12497-01": {"ajax_action": "pp_ajax_signup", "conditions": [{"name": "ARGS:reg_select_role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-12497", "description": "Paid Membership Plugin (wp-user-avatar) <4.16.18 unauthenticated privilege escalation via reg_select_role in pp_ajax_signup", "mode": "block", "severity": 7.5, "slug": "wp-user-avatar", "target": "plugin", "versions": "<4.16.18"}, "RULE-CVE-2026-1250-01": {"ajax_action": "get_court", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-1250", "description": "Court Reservation <=1.10.11 unauthenticated SQL injection via id parameter in get_court AJAX handler", "mode": "block", "severity": 7.5, "slug": "court-reservation", "target": "plugin", "versions": "<=1.10.11"}, "RULE-CVE-2026-12511-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai/v1/ai/images[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/images REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-12511-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai/v1/ai/images[\\\\\\\\/]*$~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/images REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-12511-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai/v1/ai/image_edit[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/image_edit REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-12511-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai/v1/ai/image_edit[\\\\\\\\/]*$~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~[\\\\\\\\/]~"}], "cve": "CVE-2026-12511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12511", "description": "AI Engine <3.5.5 authenticated (editor+) path traversal via filename in /ai/image_edit REST route write of downloaded image", "mode": "block", "severity": 8.1, "slug": "ai-engine", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.5.5"}, "RULE-CVE-2026-1252-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "events_listing"}, {"name": "ARGS:events_listing_url", "type": "regex", "value": "~(?:^[\\\\t\\\\n\\\\r ]*j[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*v[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*s[\\\\t\\\\n\\\\r ]*c[\\\\t\\\\n\\\\r ]*r[\\\\t\\\\n\\\\r ]*i[\\\\t\\\\n\\\\r ]*p[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*:|^[\\\\t\\\\n\\\\r ]*d[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*:|^[\\\\t\\\\n\\\\r ]*v[\\\\t\\\\n\\\\r ]*b[\\\\t\\\\n\\\\r ]*s[\\\\t\\\\n\\\\r ]*c[\\\\t\\\\n\\\\r ]*r[\\\\t\\\\n\\\\r ]*i[\\\\t\\\\n\\\\r ]*p[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*:|[\\"\'][\\\\t\\\\n\\\\r ]*(?:on[a-zA-Z0-9_]+)[\\\\t\\\\n\\\\r ]*=|<[ ]*(?:script|svg|img|iframe|object|embed|math|details|body|marquee|video|audio|input|button|select|textarea|form|base|link|meta|style)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2026-1252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1252", "description": "Events Listing Widget <=1.3.4 authenticated (Author+) stored XSS via events_listing_url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "events-listing-widget", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-1254-01": {"ajax_action": "modula_save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1254", "method": "POST", "mode": "block", "severity": 4.3, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<2.14.0"}, "RULE-CVE-2026-1258-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/email/templates(?:[/?&]|$)~"}, {"name": "ARGS:order-type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order-type parameter on email/templates REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/email/templates(?:[/?&]|$)~"}, {"name": "ARGS:order-by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order-by parameter on email/templates REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/forms(?:[/?&]|$)~"}, {"name": "ARGS:order_type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_type parameter on forms REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/forms(?:[/?&]|$)~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_by parameter on forms REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/automation(?:[/?&]|$)~"}, {"name": "ARGS:order_type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_type parameter on automation REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/automation(?:[/?&]|$)~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_by parameter on automation REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/contacts/import/tutorlms/map(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\)\\\\s+(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via selectedCourses parameter on tutorlms import REST endpoint", "method": "POST", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1266-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "postalicious"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1266", "description": "Postalicious <=3.0.1 authenticated (admin+) stored XSS via plugin settings", "method": "POST", "mode": "block", "severity": 4.4, "slug": "postalicious", "tags": ["xss", "stored", "authenticated", "admin-settings"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1268-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[dwc-content]", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1268", "description": "Dynamic Widget Content <=1.3.6 authenticated (Contributor+) stored XSS via dwc-content post meta on REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-widget-content", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2026-1268-02": {"action": "admin_init", "conditions": [{"name": "ARGS:dwc-content", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1268", "description": "Dynamic Widget Content <=1.3.6 authenticated (Contributor+) stored XSS via dwc-content post meta on classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-widget-content", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2026-1271-01": {"ajax_action": "pm_upload_image", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271", "description": "ProfileGrid <= 5.9.7.2 IDOR via pm_upload_image - virtual patch blocks non-admin profile image uploads to prevent arbitrary user image modification (FP: legitimate subscriber self-uploads blocked until plugin update)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "profilegrid-user-profiles-groups-and-communities", "tags": ["idor", "authorization-bypass", "insecure-direct-object-reference"], "target": "plugin", "versions": "<=5.9.7.2"}, "RULE-CVE-2026-1271-02": {"ajax_action": "pm_upload_cover_image", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271", "description": "ProfileGrid <= 5.9.7.2 IDOR via pm_upload_cover_image - virtual patch blocks non-admin cover image uploads to prevent arbitrary user image modification (FP: legitimate subscriber self-uploads blocked until plugin update)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "profilegrid-user-profiles-groups-and-communities", "tags": ["idor", "authorization-bypass", "insecure-direct-object-reference"], "target": "plugin", "versions": "<=5.9.7.2"}, "RULE-CVE-2026-12713-01": {"ajax_action": "view_shipment_details", "conditions": [{"name": "ARGS:shipmentID", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-12713", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12713", "description": "WPCargo Track & Trace <8.0.4 unauthenticated SQL injection hardening via shipmentID parameter in view_shipment_details AJAX handler", "mode": "block", "severity": 9.1, "slug": "wpcargo", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<8.0.4"}, "RULE-CVE-2026-12720-01": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "update-form-cell"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-12720", "description": "Kirki <=6.0.12 PHP object injection via CSRF-forged kirki_wp_admin_post_apis update-form-cell write (no nonce check) triggering unsafe unserialize on admin review", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-1273-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ultp/v3/starter_dummy_post(/|\\\\?|$)~"}, {"name": "ARGS:api_endpoint", "type": "regex", "value": "~(?:://(?:(?:127(?:[.][0-9]+){0,3}|10(?:[.][0-9]+){1,3}|172[.](?:1[6-9]|2[0-9]|3[01])(?:[.][0-9]+){1,2}|192[.]168(?:[.][0-9]+){1,2}|169[.]254(?:[.][0-9]+){0,2}|0(?:[.]0){1,3}|0x[0-9a-fA-F]+|localhost)(?:[:/?#]|$)|[[]?::1[]]?)|^(?:gopher|file|dict|ftp)://)~i"}], "cve": "CVE-2026-1273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1273", "description": "PostX <= 5.0.8 SSRF via api_endpoint parameter on /ultp/v3/starter_dummy_post/ REST route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-post", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-1273-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ultp/v3/starter_import_content(/|\\\\?|$)~"}, {"name": "ARGS:api_endpoint", "type": "regex", "value": "~(?:://(?:(?:127(?:[.][0-9]+){0,3}|10(?:[.][0-9]+){1,3}|172[.](?:1[6-9]|2[0-9]|3[01])(?:[.][0-9]+){1,2}|192[.]168(?:[.][0-9]+){1,2}|169[.]254(?:[.][0-9]+){0,2}|0(?:[.]0){1,3}|0x[0-9a-fA-F]+|localhost)(?:[:/?#]|$)|[[]?::1[]]?)|^(?:gopher|file|dict|ftp)://)~i"}], "cve": "CVE-2026-1273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1273", "description": "PostX <= 5.0.8 SSRF via api_endpoint parameter on /ultp/v3/starter_import_content/ REST route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-post", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-1277-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kc_us_dismiss_promotion", "type": "exists"}, {"name": "ARGS:redirect_to", "type": "regex", "value": "~^(?:https?:)?//(?=\\\\S)|^(?:https?:)?\\\\\\\\\\\\\\\\(?=\\\\S)~i"}], "cve": "CVE-2026-1277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1277", "description": "URL Shortify <=1.12.1 unauthenticated open redirect via redirect_to parameter in promotional dismissal handler", "mode": "block", "severity": 4.7, "slug": "url-shortify", "tags": ["open-redirect", "unauthenticated", "phishing"], "target": "plugin", "versions": "<=1.12.1"}, "RULE-CVE-2026-1279-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*(?:search_employee_directory|employee_form)\\\\b[^\\\\]]*form_title\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[^>]*>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-1279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1279", "description": "Employee Directory <=1.2.1 Stored XSS via search_employee_directory shortcode form_title attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-staff-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1279-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*(?:search_employee_directory|employee_form)\\\\b[^\\\\]]*form_title\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[^>]*>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-1279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1279", "description": "Employee Directory <=1.2.1 Stored XSS via REST API post content containing malicious shortcode form_title", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-staff-directory", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-12793-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS:options_page", "type": "exists"}, {"name": "ARGS:meta_fields_map", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-12793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12793", "description": "JetFormBuilder <=3.6.2 unauthenticated privilege escalation via missing capability check on JetEngine Update Options form action reachable through jet_form_builder_submit", "mode": "block", "severity": 9.8, "slug": "jetformbuilder", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2026-1280-01": {"ajax_action": "wpfm_send_file_in_email", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1280", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1280", "description": "Frontend File Manager Plugin <=23.5 unauthenticated arbitrary file sharing via wpfm_send_file_in_email AJAX action \\u2014 missing nonce and auth checks allow any visitor to email any uploaded file", "method": "POST", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated"], "target": "plugin", "versions": "<=23.5"}, "RULE-CVE-2026-12900-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~<!--\\\\s*wp:uagb/image\\\\b(?:(?!-->).)*?(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mousedown)\\\\s*=|javascript\\\\s*:)(?:(?!-->).)*?-->~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-12900", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-12900", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.28 contributor+ stored XSS via uagb/image block content", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["stored-xss", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=2.19.28"}, "RULE-CVE-2026-1293-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "yoast-schema"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*/\\\\s*(?i:script)~"}], "cve": "CVE-2026-1293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1293", "description": "Yoast SEO <=26.8 Authenticated (Contributor+) Stored XSS via yoast-schema block attribute in REST API post creation/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "tags": ["xss", "stored-xss", "rest-api", "gutenberg-block"], "target": "plugin", "versions": "<=26.8"}, "RULE-CVE-2026-1293-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "yoast-schema"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*/\\\\s*(?i:script)~"}], "cve": "CVE-2026-1293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1293", "description": "Yoast SEO <=26.8 Authenticated (Contributor+) Stored XSS via yoast-schema block attribute in admin post form submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "tags": ["xss", "stored-xss", "admin-post-form", "gutenberg-block"], "target": "plugin", "versions": "<=26.8"}, "RULE-CVE-2026-12937-01": {"ajax_action": "tf_room_availability", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:^|\\\\s)\'|[\'\\"]\\\\s*(?:OR|AND|UNION)\\\\s)~i"}], "cve": "CVE-2026-12937", "description": "Tourfic <=2.22.7 unauthenticated SQL injection via post_id in tf_room_availability AJAX handler", "mode": "block", "severity": 7.5, "slug": "tourfic", "target": "plugin", "versions": "<=2.22.7"}, "RULE-CVE-2026-1294-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=/?)bpivb/v1/image-proxy(?:/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1294", "method": "GET", "mode": "block", "severity": 7.2, "slug": "image-viewer", "target": "plugin", "versions": ">=1.0.0 <=1.0.2"}, "RULE-CVE-2026-1295-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[buynowplus\\\\b[^\\\\]]*(?:<script|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg|<iframe|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-1295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1295", "description": "Buy Now Plus <=1.0.2 Stored XSS via buynowplus shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "buy-now-plus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1298-01": {"ajax_action": "eri_from_url", "conditions": [{"name": "ARGS:old_image_id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1298", "description": "Easy Replace Image <=3.5.2 missing authorization on eri_from_url AJAX handler allows Contributor+ arbitrary attachment replacement", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-replace-image", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-replacement"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2026-1298-02": {"ajax_action": "eri_from_upload", "conditions": [{"name": "ARGS:old_image_id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1298", "description": "Easy Replace Image <=3.5.2 missing authorization on eri_from_upload AJAX handler allows Contributor+ arbitrary attachment replacement", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-replace-image", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-replacement"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2026-1300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<embed[\\\\s/]|<object[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1300", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1300", "description": "Responsive Header Plugin <=1.0 authenticated (Administrator+) stored XSS via plugin settings parameters", "method": "POST", "mode": "block", "severity": 4.4, "slug": "responsive-header", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editattachment"}, {"name": "ARGS:post_excerpt", "type": "regex", "value": "~(?:<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<svg[\\\\s/+>]|<iframe[\\\\s/+>]|<embed[\\\\s/+>]|<object[\\\\s/+>]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on editattachment save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1302-02": {"ajax_action": "save-attachment-compat", "conditions": [{"name": "ARGS:post_excerpt", "type": "regex", "value": "~(?:<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<svg[\\\\s/+>]|<iframe[\\\\s/+>]|<embed[\\\\s/+>]|<object[\\\\s/+>]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on AJAX save-attachment-compat", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1302-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/\\\\d+~"}, {"name": "ARGS:caption", "type": "regex", "value": "~(?:<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<svg[\\\\s/+>]|<iframe[\\\\s/+>]|<embed[\\\\s/+>]|<object[\\\\s/+>]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on REST media update", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping", "rest-api"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1303-01": {"ajax_action": "mailchimp_campaigns_manager_disconnect_app", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1303", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1303", "description": "MailChimp Campaigns <=3.2.4 missing authorization on disconnect_app AJAX action allows Subscriber+ to disconnect Mailchimp integration", "mode": "block", "severity": 5.3, "slug": "olalaweb-mailchimp-campaign-manager", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2026-1307-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/forms/[0-9]+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1307", "description": "Ninja Forms <=3.14.1 sensitive information disclosure via REST submissions endpoint accessible to Contributor+", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["information-disclosure", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-1310-01": {"ajax_action": "miga_editor_cal_delete", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1310", "description": "Simple Calendar for Elementor <=1.6.6 missing authorization on miga_editor_cal_delete AJAX action allows unauthenticated calendar entry deletion", "method": "POST", "mode": "block", "severity": 5.3, "slug": "simple-calendar-for-elementor", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2026-1310-02": {"ajax_action": "miga_editor_cal_update", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1310", "description": "Simple Calendar for Elementor <=1.6.6 missing authorization on miga_editor_cal_update AJAX action allows unauthenticated calendar entry modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "simple-calendar-for-elementor", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2026-1311-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "worrprba_ajax_upload_backup_file"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1311", "description": "Worry Proof Backup <=0.2.4 authenticated (Subscriber+) path traversal via backup ZIP upload leading to arbitrary file write and RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "worry-proof-backup", "tags": ["path-traversal", "arbitrary-file-write", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=0.2.4"}, "RULE-CVE-2026-1311-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/worrprba/v1/upload-chunk(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1311", "description": "Worry Proof Backup <=0.2.4 REST API upload-chunk endpoint path traversal via unsanitized chunk file upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "worry-proof-backup", "tags": ["path-traversal", "arbitrary-file-write", "rest-api"], "target": "plugin", "versions": "<=0.2.4"}, "RULE-CVE-2026-1314-01": {"ajax_action": "fb3d_send_post_pages", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1314", "description": "Interactive 3D FlipBook <=1.16.17 missing authorization on fb3d_send_post_pages AJAX action allows unauthenticated post page metadata disclosure", "mode": "block", "severity": 5.3, "slug": "interactive-3d-flipbook-powered-physics-engine", "target": "plugin", "versions": "<=1.16.17"}, "RULE-CVE-2026-13147-01": {"ajax_action": "kirki_get_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "get-pre-built-html"}, {"name": "ARGS:elementUrl", "type": "regex", "value": "~^(?:(?!https?://)[a-zA-Z][a-zA-Z0-9_+.-]*:)|^https?://(?:localhost|127(?:\\\\.[0-9]{1,3}){3}|0\\\\.0\\\\.0\\\\.0|10(?:\\\\.[0-9]{1,3}){3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])(?:\\\\.[0-9]{1,3}){2}|192\\\\.168(?:\\\\.[0-9]{1,3}){2}|169\\\\.254(?:\\\\.[0-9]{1,3}){2}|\\\\[::1\\\\]|\\\\[fe80|\\\\[fc|\\\\[fd)~i"}], "cve": "CVE-2026-13147", "description": "Kirki <6.0.12 unauthenticated SSRF via elementUrl parameter in kirki_get_apis get-pre-built-html endpoint", "mode": "block", "severity": 9.1, "slug": "kirki", "target": "plugin", "versions": "<6.0.12"}, "RULE-CVE-2026-1316-01": {"ajax_action": "cr_upload_media", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1316", "description": "Customer Reviews for WooCommerce <=5.97.0 unauthenticated stored XSS via media[].href in cr_upload_media AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.97.0"}, "RULE-CVE-2026-1316-02": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1316", "description": "Customer Reviews for WooCommerce <=5.97.0 unauthenticated stored XSS via media[].href in cr_submit_review AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.97.0"}, "RULE-CVE-2026-1319-01": {"ajax_action": "wio_ng_reoptimize_image", "conditions": [{"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2026-1319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1319", "description": "Robin Image Optimizer <=2.0.2 reflected XSS via id parameter in wio_ng_reoptimize_image AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "robin-image-optimizer", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-1319-02": {"ajax_action": "wio_ng_restore_image", "conditions": [{"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2026-1319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1319", "description": "Robin Image Optimizer <=2.0.2 reflected XSS via id parameter in wio_ng_restore_image AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "robin-image-optimizer", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-1320-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "detectXSS"}], "config": {}, "cve": "CVE-2026-1320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1320", "description": "Secure Copy Content Protection <= 4.9.8 stored XSS via X-Forwarded-For header in IP logging", "mode": "block", "severity": 7.2, "slug": "secure-copy-content-protection", "tags": ["xss", "stored", "header-injection"], "target": "plugin", "versions": "<4.9.9"}, "RULE-CVE-2026-1321-01": {"ajax_action": "rcp_process_register_form", "conditions": [{"name": "ARGS:rcp_level", "type": "exists"}, {"name": "ARGS:rcp_gateway", "type": "equals", "value": "free"}], "cve": "CVE-2026-1321", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1321", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.20 unauthenticated privilege escalation via rcp_level parameter in AJAX registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "restrict-content", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-13246-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~givewp_campaign_comments[^\\\\]]*block_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\'\\\\s*(?:on[a-z]+=|style\\\\s*=)|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13246", "description": "GiveWP <=4.16.0 authenticated (author+) stored XSS via block_id attribute of givewp_campaign_comments shortcode in post content (Classic editor)", "mode": "block", "severity": 6.4, "slug": "give", "target": "plugin", "versions": "<=4.16.0"}, "RULE-CVE-2026-13246-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~givewp_campaign_comments[^\\\\]]*block_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\'\\\\s*(?:on[a-z]+=|style\\\\s*=)|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13246", "description": "GiveWP <=4.16.0 authenticated (author+) stored XSS via block_id attribute of givewp_campaign_comments shortcode in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "give", "target": "plugin", "versions": "<=4.16.0"}, "RULE-CVE-2026-13352-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~i"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:exe|apk|msi)[\\\\s.]*$~i"}], "cve": "CVE-2026-13352", "description": "ProfilePress (wp-user-avatar) <=4.16.18 authenticated arbitrary executable file upload via unconditionally widened upload_mimes MIME allowlist (exe/apk/msi) affecting WordPress core media upload (async-upload.php)", "mode": "block", "severity": 8.8, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.16.18"}, "RULE-CVE-2026-1336-01": {"ajax_action": "ays_chatgpt_admin_ajax", "conditions": [{"name": "ARGS:ays_chatgpt_assistant_api_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1336", "description": "AI ChatBot with ChatGPT and Content Generator by AYS <=2.7.5 unauthenticated API key modification via ays_chatgpt_admin_ajax AJAX handler", "mode": "block", "severity": 5.3, "slug": "ays-chatgpt-assistant", "tags": ["missing-authorization", "unauthenticated", "settings-modification"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2026-13392-01": {"action": "admin_init", "conditions": [{"name": "ARGS:settings[menu_id]", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13392", "description": "ElementsKit Elementor Addons <3.10.01 multisite subsite administrator privilege escalation via megamenu item settings save missing unfiltered_html/super-admin gate", "mode": "block", "severity": 7.2, "slug": "elementskit-lite", "tags": ["privilege-escalation", "missing-authorization", "multisite", "remote-code-execution"], "target": "plugin", "versions": "<3.10.01"}, "RULE-CVE-2026-13399-01": {"ajax_action": "wc_ppcp_admin_request", "conditions": [{"name": "ARGS:path", "type": "exists"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-13399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13399", "description": "Payment Plugins for PayPal WooCommerce <2.0.20 missing authorization on wc_ppcp_admin_request AJAX handler allows any authenticated user to forward arbitrary internal REST route paths via the path parameter", "mode": "block", "severity": 7.5, "slug": "pymntpl-paypal-woocommerce", "tags": ["missing-authorization", "authenticated", "privilege-escalation"], "target": "plugin", "versions": "<2.0.20"}, "RULE-CVE-2026-13415-01": {"ajax_action": "cmp_ajax_import_settings", "conditions": [{"name": "ARGS:json", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-13415", "description": "CMP Coming Soon & Maintenance <4.1.18 Editor-role arbitrary WordPress option update via cmp_ajax_import_settings settings-import AJAX action, leading to privilege escalation to Administrator", "mode": "block", "severity": 7.2, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<4.1.18"}, "RULE-CVE-2026-13424-01": {"ajax_action": "bookly_speed_up_update_addons", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img[^>]+onerror)~i"}], "cve": "CVE-2026-13424", "description": "Bookly <=27.7 unauthenticated stored XSS via bookly_speed_up_update_addons AJAX action logged to Diagnostics Logs", "mode": "block", "severity": 7.2, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.7"}, "RULE-CVE-2026-13456-01": {"ajax_action": "fc_communication", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-13456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13456", "description": "WP Maps - Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters (wp-google-map-plugin) <=4.9.8 missing authorization on fc_communication AJAX handler in core/class.initiate-core.php, sharing the file with the LFI include() sink", "mode": "pass", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["missing-authorization", "local-file-inclusion", "authenticated"], "target": "plugin", "versions": "<=4.9.8"}, "RULE-CVE-2026-13596-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS:/search_field|id|pid|private_id/", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*][^*]*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"0-9])~i"}], "cve": "CVE-2026-13596", "description": "Participants Database <2.7.8.4 unauthenticated SQL injection via pdb_list_filter AJAX list/search filter parameters", "mode": "block", "slug": "participants-database", "target": "plugin", "versions": "<2.7.8.4"}, "RULE-CVE-2026-1360-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/xprofile/[0-9]+/data/[0-9]+~i"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-1360", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1360", "description": "BuddyPress <=14.5.0 authenticated (subscriber+) PHP object injection via unserialize() without allowed_classes in bp_unserialize_profile_field() through XProfile REST data write endpoint", "mode": "block", "severity": 7.5, "slug": "buddypress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=14.5.0"}, "RULE-CVE-2026-1368-01": {"ajax_action": "get_auth", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1368", "description": "Video Conferencing with Zoom API <4.6.6 unauthenticated Zoom SDK key disclosure via get_auth AJAX handler", "mode": "block", "severity": 7.5, "slug": "video-conferencing-with-zoom-api", "tags": ["improper-authentication", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<4.6.6"}, "RULE-CVE-2026-1369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:redirect_to", "type": "regex", "value": "~^(?:[a-z][a-z0-9+.-]*:|//|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-1369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1369", "description": "WP Conditional Captcha <=4.0.0 unauthenticated open redirect via redirect_to in comment submission flow", "mode": "block", "severity": 4.3, "slug": "wp-conditional-captcha", "tags": ["open-redirect", "unauthenticated", "comment-form"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-13704-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:sequoia[introduction][image]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change|submit)\\\\s*=|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*(?:text/html|application/javascript)|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-13704", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-13704", "description": "GiveWP <=4.16.1 authenticated (Give Worker+) stored XSS via sequoia[introduction][image] parameter in Sequoia donation form metabox save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "give", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.16.1"}, "RULE-CVE-2026-1373-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:author_profile_picture_url", "type": "regex", "value": "~(?:<\\\\s*script|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1373", "description": "Easy Author Image <=1.7 Stored XSS via author_profile_picture_url on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-author-image", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2026-1373-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:author_profile_picture_url", "type": "regex", "value": "~(?:<\\\\s*script|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1373", "description": "Easy Author Image <=1.7 Stored XSS via author_profile_picture_url on admin user-edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-author-image", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2026-1375-01": {"ajax_action": "tutor_course_list_bulk_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1375", "description": "Tutor LMS <=3.9.5 IDOR in course bulk action allows instructors to modify/delete arbitrary courses via tutor_course_list_bulk_action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tutor", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.9.5"}, "RULE-CVE-2026-1375-03": {"ajax_action": "tutor_course_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1375", "description": "Tutor LMS <=3.9.5 IDOR in course deletion allows instructors to delete arbitrary courses via tutor_course_delete", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tutor", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.9.5"}, "RULE-CVE-2026-1391-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vzaar-media-management"}, {"name": "ARGS:bulkcheck", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via bulkcheck parameter on admin upload page", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-02": {"action": "admin_init", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "vzaarmedia"}, {"name": "ARGS:guid", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via guid parameter on media upload tab", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-03": {"action": "admin_init", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "vzaarmedia"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via post_id parameter on media upload tab", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vzaar-media-management"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc]|<)[a-zA-Z/!]~"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via PHP_SELF path injection on admin upload page", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1394-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcEmail", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcEmail parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1394-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcSubject", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcSubject parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1394-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcSuccessMsg", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcSuccessMsg parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1400-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/helpers/update_media_metadata(?:/|\\\\?|&|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-1400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1400", "description": "AI Engine <=3.3.2 authenticated (Editor+) arbitrary file upload via filename parameter in update_media_metadata REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["arbitrary-file-upload", "file-rename", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1401-01": {"action": "admin_post_tune_lib_admin", "conditions": [{"name": "ARGS:importcsv", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1401", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1401", "description": "Tune Library <=1.6.3 missing authorization on CSV import allows authenticated (Subscriber+) stored XSS via admin_post_tune_lib_admin", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tune-library", "tags": ["missing-authorization", "stored-xss", "csv-import", "authenticated"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2026-1401-02": {"action": "admin_post_tune_lib_admin", "conditions": [{"name": "ARGS:importitunes", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1401", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1401", "description": "Tune Library <=1.6.3 missing authorization on iTunes import allows authenticated (Subscriber+) stored XSS via admin_post_tune_lib_admin", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tune-library", "tags": ["missing-authorization", "stored-xss", "itunes-import", "authenticated"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2026-1404-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX search parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-02": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:sorting", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX sorting parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-03": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:filter_tag", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX filter_tag parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-04": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:directory_id", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX directory_id parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-14182-01": {"ajax_action": "verify_otp", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^otp\\\\[~i"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via array-type otp submission to verify_otp (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-14182-02": {"ajax_action": "verify_otp", "conditions": [{"name": "ARGS:otp", "type": "regex", "value": "~^(?![0-9]+$).*$~"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via non-numeric otp value to verify_otp (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-14182-03": {"ajax_action": "cev_verify_user_email_with_pin", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^cev_pin1\\\\[~i"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via array-type cev_pin1 submission to cev_verify_user_email_with_pin (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-14182-04": {"ajax_action": "cev_verify_user_email_with_pin", "conditions": [{"name": "ARGS:cev_pin1", "type": "regex", "value": "~^(?![0-9]+$).*$~"}], "cve": "CVE-2026-14182", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14182", "description": "Customer Email Verification for WooCommerce <3.2.6 unauthenticated account takeover via non-numeric cev_pin1 value to cev_verify_user_email_with_pin (PHP loose-comparison type juggling)", "mode": "block", "severity": 9.8, "slug": "customer-email-verification-for-woocommerce", "tags": ["authentication-bypass", "type-juggling", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<3.2.6"}, "RULE-CVE-2026-1431-01": {"ajax_action": "WPBC_FLEXTIMELINE_NAV", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1431", "description": "Booking Calendar <=10.14.13 unauthenticated booking data exposure via WPBC_FLEXTIMELINE_NAV AJAX action", "mode": "block", "severity": 5.3, "slug": "booking", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=10.14.13"}, "RULE-CVE-2026-14483-01": {"action": "init", "conditions": [{"name": "ARGS:wplformat", "type": "equals", "value": "io"}, {"name": "ARGS:wplview", "type": "equals", "value": "io"}, {"name": "FILES:files:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-14483", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14483", "description": "Real Estate Listing Realtyna WPL <=5.2.0 unauthenticated arbitrary file upload via public I/O service dispatcher (wplformat=io/wplview=io) file upload", "mode": "block", "severity": 9.8, "slug": "real-estate-listing-realtyna-wpl", "tags": ["unrestricted-file-upload", "unauthenticated", "remote-code-execution", "static-credentials"], "target": "plugin", "versions": "<=5.2.0"}, "RULE-CVE-2026-1454-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]{0,512}on[a-zA-Z]{3,30}[ \\\\t\\\\r\\\\n]*=~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - event handler injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1454-02": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[ \\\\t\\\\r\\\\n]*script(?:[ \\\\t\\\\r\\\\n]|>|/|$)~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - script tag injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1454-03": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~javascript(?:[ \\\\t\\\\r\\\\n]|%0[aAdD]|%09|&#0*9;|&#0*10;|&#0*13;|&Tab;|&NewLine;)*:~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - javascript URI injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1455-01": {"ajax_action": "wsnfw_save_users_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_users_settings", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-02": {"ajax_action": "wsnfw_save_credentials", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_credentials", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-03": {"ajax_action": "wsnfw_save_wc_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_wc_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-04": {"ajax_action": "wsnfw_save_users_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_users_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-05": {"ajax_action": "wsnfw_save_gf_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_gf_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1461-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:swpm_process_stripe_subscription", "type": "equals", "value": "1"}, {"name": "ARGS:hook", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1461", "description": "Simple Membership <=4.7.0 unauthenticated Stripe webhook signature bypass via missing signing secret validation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-membership", "tags": ["signature-bypass", "unauthenticated", "webhook-forge", "improper-handling-missing-values"], "target": "plugin", "versions": "<=4.7.0"}, "RULE-CVE-2026-14817-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~data-(?:bdt-[a-zA-Z0-9_-]+|attrs)\\\\s*=\\\\s*(?:\\"|&quot;|\')[^\\"\'>]*?\\\\b(?:template|on[a-zA-Z]{2,20})\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-14817", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-14817", "description": "Element Pack Addons for Elementor <8.7.13 contributor+ stored XSS via unsanitized data-bdt-*/data-attrs UIkit attributes in post content", "mode": "block", "severity": 6.8, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "authenticated", "contributor"], "target": "plugin", "versions": "<8.7.13"}, "RULE-CVE-2026-1492-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "user_registration_user_form_submit"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in user_registration_user_form_submit AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1492-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_.+$~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in membership registration AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1492-03": {"action": "init", "conditions": [{"name": "ARGS:ur_frontend_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in frontend form submission", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1499-01": {"ajax_action": "process_add_site", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "local-sync", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-15005-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:page", "type": "regex", "value": "~^loco~i"}, {"name": "ARGS:template", "type": "regex", "value": "~(?:^(?:php|phar|data|expect|zip|glob|ftps?|https?|compress\\\\.(?:zlib|bzip2)|ssh2|ogg|rar|zlib)://|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}], "cve": "CVE-2026-15005", "description": "Loco Translate <=2.8.5 CSRF-driven local file inclusion via php stream-wrapper URI in template parameter reaching execTemplate include sink", "mode": "block", "severity": 8.8, "slug": "loco-translate", "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2026-15038-01": {"action": "setup_theme", "conditions": [{"name": "ARGS:iwp_action", "type": "equals", "value": "add_site"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-15038", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15038", "description": "InfiniteWP Client <1.13.6 unauthenticated site-connection key bind bypass via empty activation_key on add_site", "mode": "block", "severity": 9.8, "slug": "iwp-client", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "multisite"], "target": "plugin", "versions": "<1.13.6"}, "RULE-CVE-2026-15038-02": {"action": "setup_theme", "conditions": [{"name": "ARGS:iwp_action", "type": "equals", "value": "readd_site"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-15038", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15038", "description": "InfiniteWP Client <1.13.6 unauthenticated site-connection key bind bypass via empty activation_key on readd_site", "mode": "block", "severity": 9.8, "slug": "iwp-client", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "multisite"], "target": "plugin", "versions": "<1.13.6"}, "RULE-CVE-2026-15096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_save_data"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 contributor+ stored XSS via b_width_map field in tb_save_data builder save handler (flat param)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_save_data"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 contributor+ stored XSS via b_width_map field nested in tb_save_data JSON data payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field in tb_render_element live builder render handler (flat param)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field nested in tb_render_element JSON module payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element_shortcode"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field in tb_render_element_shortcode render handler (flat param, sibling of tb_render_element)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element_shortcode"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field nested in tb_render_element_shortcode JSON module payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15145-01": {"action": "init", "conditions": [{"name": "ARGS:fancy-text-transition-type", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-15145", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15145", "description": "Essential Addons for Elementor Lite <=6.6.11 stored XSS via Fancy Text widget transition-type value rendered client-side without sanitization", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=6.6.11"}, "RULE-CVE-2026-15244-01": {"ajax_action": "woof_save_options", "conditions": [{"name": "ARGS:formdata", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|zip|phar|expect|glob)://~i"}], "cve": "CVE-2026-15244", "description": "HUSKY WooCommerce Products Filter <1.4.1 shop-manager stored path traversal via search_view leading to local file inclusion", "mode": "block", "slug": "woocommerce-products-filter", "target": "plugin", "versions": "<1.4.1"}, "RULE-CVE-2026-15359-01": {"action": "init", "conditions": [{"name": "ARGS:templately_google_login", "type": "exists"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2026-15359", "description": "Templately <3.7.1 unauthenticated overwrite of administrator cloud connection via unauthenticated google_login_handler init-hook callback", "mode": "block", "severity": 6.5, "slug": "templately", "target": "plugin", "versions": "<3.7.1"}, "RULE-CVE-2026-15361-01": {"ajax_action": "contentviews_elementor_search_post", "conditions": [{"name": "ARGS:/post_type|term/", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+\\\\b|/\\\\*.*?\\\\*/|--\\\\s)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-15361", "description": "Content Views <=4.4 authenticated SQL injection via post_type/term in contentviews_elementor_search_post AJAX action", "mode": "block", "slug": "content-views-query-and-display-post-page", "target": "plugin", "versions": "<=4.4"}, "RULE-CVE-2026-15361-02": {"ajax_action": "contentviews_elementor_get_title", "conditions": [{"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-15361", "description": "Content Views <=4.4 missing authorization on contentviews_elementor_get_title AJAX action allows subscriber-level lookup abuse", "mode": "block", "slug": "content-views-query-and-display-post-page", "target": "plugin", "versions": "<=4.4"}, "RULE-CVE-2026-1537-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "steps__load_step"}, {"name": "ARGS:booking[id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1537", "description": "LatePoint <=5.2.6 IDOR in load_step \\u2014 unauthenticated booking data disclosure via booking[id] in public wizard AJAX", "method": "POST", "mode": "block", "severity": 5.3, "slug": "latepoint", "tags": ["missing-authorization", "information-disclosure", "idor", "unauthenticated"], "target": "plugin", "versions": "<=5.2.6"}, "RULE-CVE-2026-1537-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:route_name", "type": "equals", "value": "steps__load_step"}, {"name": "ARGS:booking[id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1537", "description": "LatePoint <=5.2.6 IDOR in load_step \\u2014 unauthenticated booking data disclosure via booking[id] in admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "latepoint", "tags": ["missing-authorization", "information-disclosure", "idor", "unauthenticated"], "target": "plugin", "versions": "<=5.2.6"}, "RULE-CVE-2026-15372-01": {"action": "login_form_validate_2fa", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp-auth-id", "type": "exists"}, {"name": "ARGS:wp-auth-nonce", "type": "exists"}, {"name": "ARGS:authcode", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-15372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15372", "description": "WP 2FA <4.1.0 second-factor authentication bypass at login when the authentication code field is submitted empty during the pending 2FA challenge step", "mode": "block", "severity": 7.5, "slug": "wp-2fa", "tags": ["authentication-bypass", "two-factor-bypass", "unauthenticated"], "target": "plugin", "versions": "<4.1.0"}, "RULE-CVE-2026-1540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "wpcf7"}, {"name": "ARGS:post", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>]|document\\\\.(?:cookie|write|location)|eval\\\\s*\\\\()~i"}], "cve": "CVE-2026-1540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1540", "description": "Spam Protect for Contact Form 7 <=1.2.9 authenticated (admin+) stored XSS / code injection via unsanitized CF7 form settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-contact-form-7-spam-blocker", "tags": ["xss", "stored", "code-injection", "authenticated"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2026-15414-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wps_membership_plan"}, {"name": "ARGS:_wps_plan_user_role", "type": "exists"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-15414", "description": "Subscriptions for WooCommerce <=2.0.0 privilege escalation via _wps_plan_user_role membership plan meta persisted without manage_woocommerce authorization", "mode": "block", "slug": "subscriptions-for-woocommerce", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-1542-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;&])O:[0-9]+:\\"[A-Za-z_]~"}], "cve": "CVE-2026-1542", "method": "POST", "mode": "block", "severity": 6.5, "slug": "super-stage-wp", "target": "plugin", "versions": "<1.0.2"}, "RULE-CVE-2026-15446-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img\\\\b(?=[^>]*\\\\bclass\\\\s*=\\\\s*[\\"\'][^\\"\']*\\\\blazyload\\\\b)(?=[^>]*\\\\bdata-script\\\\s*=\\\\s*[\\"\'](?:https?:)?//)[^>]*>~i"}], "cve": "CVE-2026-15446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15446", "description": "EWWW Image Optimizer <=8.7.3 authenticated (contributor+) stored XSS via lazyload data-script attribute in post content", "mode": "block", "severity": 6.4, "slug": "ewww-image-optimizer", "tags": ["stored-xss", "authenticated", "lazy-load-injection"], "target": "plugin", "versions": "<=8.7.3"}, "RULE-CVE-2026-15459-01": {"action": "init", "conditions": [{"name": "ARGS:wpmudev-hub", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-15459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15459", "description": "WPMU DEV Dashboard <= 5.0.0 unauthenticated authentication bypass. The Hub remote handler is bound to the public init hook with no capability check and is gated only by the WDP-AUTH request signature, which validate_hash() verifies with the site API key. On sites not yet connected to the WPMU DEV Hub (the default state after installation) that key is empty, so the signature is trivially forgeable and unauthenticated attackers can invoke privileged Hub actions: installing and activating a plugin from an attacker-supplied URL (RCE), deleting plugins and themes, upgrading core, or logging in as administrator via SSO. The handler returns immediately unless the wpmudev-hub query parameter is present, so that parameter is the mandatory entry point for every exploit attempt.", "mode": "block", "severity": 8.1, "slug": "wpmudev-updates", "tags": ["auth-bypass", "unauthenticated", "rce", "privilege-escalation"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2026-1557-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-responsive-images/image_handler\\\\.php~"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/passwd|(?:^|[\\\\\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)$)~i"}], "cve": "CVE-2026-1557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1557", "description": "WP Responsive Images <=1.0 unauthenticated path traversal to arbitrary file read via src parameter in image_handler.php", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wp-responsive-images", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "local-file-inclusion"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1560-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazy-blocks/v1/block-builder-preview(/|\\\\?|&|$)~"}, {"name": "REQUEST_COOKIES:/^wordpress_logged_in_/", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1560", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lazy-blocks", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-1565-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:type", "type": "equals", "value": "wpuf-form-uploader"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1565", "description": "WP User Frontend <=4.2.8 authenticated (Author+) arbitrary file upload via upload-attachment with wpuf-form-uploader type bypass", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["arbitrary-file-upload", "file-upload-extension-bypass", "missing-authorization"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-1565-02": {"ajax_action": "wpuf_import_forms", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1565", "description": "WP User Frontend <=4.2.8 authenticated (Author+) arbitrary file import via wpuf_import_forms AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["arbitrary-file-upload", "missing-authorization"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-1566-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:customer[wordpress_user_id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1566", "description": "LatePoint <=5.2.7 privilege escalation via mass-assignment of customer[wordpress_user_id] through AJAX route dispatcher", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "improper-privilege-management", "mass-assignment"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2026-1566-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:customer[wordpress_user_id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1566", "description": "LatePoint <=5.2.7 privilege escalation via mass-assignment of customer[wordpress_user_id] through admin-post route dispatcher", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "improper-privilege-management", "mass-assignment"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2026-1569-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wueen-blocket\\\\b[^\\\\]]*err-404\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1569", "description": "Wueen <=0.2.0 contributor+ stored XSS via wueen-blocket shortcode err-404 attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wueen", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2026-1569-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wueen-blocket\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1569", "description": "Wueen <=0.2.0 contributor+ stored XSS via wueen-blocket shortcode id attribute reflected through err-404 template", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wueen", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2026-1569-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-admin/post(?:-new)?\\\\.php|wp-admin/admin-ajax\\\\.php)\\\\b~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:wueen-blocket)\\\\b[^\\\\]]*\\\\bv-[a-zA-Z0-9_]+\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<script\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:|on(?:error|load|mouseover|click|focus|blur)\\\\s*=)[^\\"\'\\\\]]*[\\"\'][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1569", "description": "Wueen <=0.2.0 contributor+ stored XSS via wueen-blocket shortcode v-* variable attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wueen", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2026-1570-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[verse"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]verse[^]]*(?:<script|<svg|<iframe|<img|on[a-zA-Z]+=|javascript:|data:[a-zA-Z]+/[a-zA-Z]+)~i"}], "cve": "CVE-2026-1570", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1570", "description": "Simple Bible Verse Via Shortcode <=1.1 Stored XSS via [verse] shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-bible-verse-via-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1574-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\']\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title attribute breakout (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*>\\\\s*<~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title tag injection (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip[^\\\\]]*\\\\].*<script~is"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode body script injection (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\']\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title attribute breakout (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*>\\\\s*<~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip[^\\\\]]*\\\\].*<script~is"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode body script injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-15748-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_form_~"}, {"name": "FILES:upload-1:name", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|t|tm|tml|ar|ps?)|htaccess|user\\\\.ini)$~i"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE via public form submission (server-executable filename on upload-1). Covers this field id only - the engine cannot yet express a scan across every upload field, so an upload sent under any other name is caught by RULE-CVE-2026-15748-05 instead of here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "FILES:upload-1:name", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|t|tm|tml|ar|ps?)|htaccess|user\\\\.ini)$~i"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 hardening - PHP-executable filename submitted to the forminator_multiple_file_upload AJAX endpoint on upload-1. Defence-in-depth, not the CVE-2026-15748 exploit path. That handler resolves the upload field config from the stored form definition (Forminator_CForm_Front::multiple_file_upload -> module_object->get_field), so the attacker-controlled filetypes/custom-files injection cannot be reached here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_form_~"}, {"name": "FILES:upload-2:name", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|t|tm|tml|ar|ps?)|htaccess|user\\\\.ini)$~i"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE via public form submission (server-executable filename on upload-2). Covers this field id only - the engine cannot yet express a scan across every upload field, so an upload sent under any other name is caught by RULE-CVE-2026-15748-05 instead of here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-04": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "FILES:upload-2:name", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|t|tm|tml|ar|ps?)|htaccess|user\\\\.ini)$~i"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 hardening - PHP-executable filename submitted to the forminator_multiple_file_upload AJAX endpoint on upload-2. Defence-in-depth, not the CVE-2026-15748 exploit path. That handler resolves the upload field config from the stored form definition (Forminator_CForm_Front::multiple_file_upload -> module_object->get_field), so the attacker-controlled filetypes/custom-files injection cannot be reached here", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_(?:preview_)?form_~"}, {"name": "ARGS:/^.+$/[return]", "type": "exists"}, {"name": "ARGS:/^.+$/[field_type]", "type": "equals", "value": "upload"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE - field_data_array injection via a client-supplied `return` key carrying a forged upload field config (matches the vulnerability primitive, independent of the uploaded file field name)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15748-06": {"action": "init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-15748-05", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_(?:preview_)?form_~"}, {"name": "ARGS:/^.+$/[return]", "type": "exists"}], "cve": "CVE-2026-15748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748", "description": "Forminator <=1.56.1 companion sampler - any client-supplied `return` key on a public form submission (the sanitize/validate bypass primitive, regardless of injected field type). Pass-only, measures whether RULE-CVE-2026-15748-05 misses real attacks", "method": "POST", "mode": "pass", "severity": 9.8, "slug": "forminator", "tags": ["file-upload", "arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.56.1"}, "RULE-CVE-2026-15797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "popup"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:&lt;?|&#0*60;?|&#x0*3c;?)\\\\s*(?:script|iframe|svg|img|body|object|embed|on[a-z]+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-15797", "description": "Popup Maker <=1.24.0 contributor+ stored XSS via HTML entity-encoded payload in post_title on the popup post type", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<=1.24.0"}, "RULE-CVE-2026-15798-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:data-href|data-redirect-url)\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|vbscript)\\\\s*(?::|&#0*58;?|&colon;)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-15798", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15798", "description": "Smart Slider 3 <=3.5.1.38 stored XSS via unsanitized data-href/data-redirect-url slide link attributes for users lacking unfiltered_html", "mode": "block", "severity": 6.4, "slug": "smart-slider-3", "tags": ["xss", "stored-xss", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.5.1.38"}, "RULE-CVE-2026-1581-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-1581", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.14"}, "RULE-CVE-2026-15988-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mcp/v1/oauth/authorize[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-15988", "description": "AI Engine <=3.6.5 CSRF-based REST authentication bypass via missing nonce validation on reauth_for_authorize (mcp/v1/oauth/authorize)", "mode": "block", "slug": "ai-engine", "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-15988-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mcp/v1/oauth/authorize[\\\\\\\\/]*$~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-15988", "description": "AI Engine <=3.6.5 CSRF-based REST authentication bypass via missing nonce validation on reauth_for_authorize (mcp/v1/oauth/authorize)", "mode": "block", "slug": "ai-engine", "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-1608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]youtube[^]]*(?:on[a-zA-Z]+=|javascript:|<script|<img[^>]+onerror)~i"}], "cve": "CVE-2026-1608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1608", "description": "Video Onclick <=0.4.7 Stored XSS via youtube shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "video-onclick", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.7"}, "RULE-CVE-2026-1608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]youtube[^]]*(?:on[a-zA-Z]+=|javascript:|<script|<img[^>]+onerror)~i"}], "cve": "CVE-2026-1608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1608", "description": "Video Onclick <=0.4.7 Stored XSS via youtube shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "video-onclick", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.4.7"}, "RULE-CVE-2026-1611-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wikiloops\\\\b[^\\\\]]*(?:<[^>]+>|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1611", "description": "Wikiloops Track Player <=1.0.1 Stored XSS via wikiloops shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wikiloops-track-player", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wikiloops\\\\b[^\\\\]]*(?:<[^>]+>|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1611", "description": "Wikiloops Track Player <=1.0.1 Stored XSS via wikiloops shortcode attributes in REST API content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wikiloops-track-player", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1614-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post create", "method": "POST", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1620-01": {"ajax_action": "lae_admin_ajax", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.{2,}/+){2,}|(?:php|phar|data|expect|zip|glob)://|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1620", "description": "Livemesh Addons for Elementor <=9.0 authenticated (Contributor+) Local File Inclusion via template parameter in lae_admin_ajax handler", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=9.0"}, "RULE-CVE-2026-1634-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~subitem-al-slider~"}, {"name": "REQUEST_URI", "type": "detectXSS"}], "cve": "CVE-2026-1634", "method": "GET", "mode": "block", "severity": 6.1, "slug": "subitem-al-slider", "target": "plugin", "versions": "<1.1"}, "RULE-CVE-2026-1639-01": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-1639", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1639", "description": "Taskbuilder <=5.0.2 authenticated (Subscriber+) SQL injection via order parameter in wppm_get_project_list AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "taskbuilder", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-1639-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:sort_by", "type": "detectSQLi"}], "cve": "CVE-2026-1639", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1639", "description": "Taskbuilder <=5.0.2 authenticated (Subscriber+) SQL injection via sort_by parameter in wppm_get_project_list AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "taskbuilder", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-1643-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mp-ukagaka"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:[<>\\"\'=]|%(?:22|27|3[CEce]|3[Dd]))~i"}], "cve": "CVE-2026-1643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1643", "description": "MP-Ukagaka <=1.5.2 Reflected XSS via unsanitized PHP_SELF in admin settings page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mp-ukagaka", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-1643-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mp-ukagaka"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:[<>\\"\'=]|%(?:22|27|3[CEce]|3[Dd]))~i"}], "cve": "CVE-2026-1643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1643", "description": "MP-Ukagaka <=1.5.2 Reflected XSS via unsanitized PHP_SELF in admin settings page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mp-ukagaka", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-1644-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:approve|deny|block)$~i"}, {"name": "ARGS:user", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-1644", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1644", "description": "WP Front End Profile <=1.3.8 CSRF on user approval/denial/blocking via update_action on users.php", "mode": "block", "severity": 4.3, "slug": "wp-front-end-profile", "tags": ["csrf", "missing-authorization", "user-management"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2026-1646-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenberg-extend/posts-block\\\\s*\\\\{[^}]*\\"(?:TitleColor|boxColor|TxtFontSize)\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<[a-z][\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mousedown|keydown|keyup)\\\\s*=|javascript\\\\s*:|</style\\\\s*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1646", "description": "Advance Block Extend <=1.0.4 contributor+ stored XSS via TitleColor/boxColor/TxtFontSize block attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advance-block-extend", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-1646-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~gutenberg-extend/posts-block\\\\s*\\\\{[^}]*\\"(?:TitleColor|boxColor|TxtFontSize)\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<[a-z][\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mousedown|keydown|keyup)\\\\s*=|javascript\\\\s*:|</style\\\\s*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1646", "description": "Advance Block Extend <=1.0.4 contributor+ stored XSS via TitleColor/boxColor/TxtFontSize block attributes in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advance-block-extend", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-1649-01": {"action": "admin_post_save_community_events_venues", "conditions": [{"name": "ARGS:ce_venue_name", "type": "detectXSS"}], "cve": "CVE-2026-1649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1649", "description": "Community Events <=1.5.7 authenticated stored XSS via ce_venue_name in venue save handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "community-events", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2026-1650-01": {"action": "admin_init", "conditions": [{"name": "ARGS:delete_custom_field", "type": "exists"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_mdjm"}], "cve": "CVE-2026-1650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1650", "description": "MDJM Event Management <=1.7.8.1 unauthenticated arbitrary custom field deletion via delete_custom_field parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "mobile-dj-manager", "tags": ["missing-authorization", "unauthenticated", "arbitrary-deletion"], "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2026-1650-02": {"action": "admin_init", "conditions": [{"name": "ARGS:submit_custom_field", "type": "exists"}, {"type": "missing_capability", "value": "manage_mdjm"}], "cve": "CVE-2026-1650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1650", "description": "MDJM Event Management <=1.7.8.1 unauthenticated arbitrary custom field creation/update via submit_custom_field parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mobile-dj-manager", "tags": ["missing-authorization", "unauthenticated", "arbitrary-modification"], "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2026-16502-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_code in save-composer AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-02": {"ajax_action": "dslc-ajax-save-draft-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_code in save-draft-composer AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-03": {"ajax_action": "dslc-ajax-save-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_template_code in save-template AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-04": {"ajax_action": "dslc-ajax-import-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_template_code in import-template AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-05": {"ajax_action": "dslc-ajax-save-preset", "conditions": [{"name": "ARGS:dslc_preset_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_preset_code in save-preset AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-16502-06": {"ajax_action": "dslc-ajax-import-modules-section", "conditions": [{"name": "ARGS:dslc_modules_section_code", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-16502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16502", "description": "Live Composer <=2.1.18 authenticated (contributor+) PHP object injection via dslc_modules_section_code in import-modules-section AJAX handler", "mode": "block", "severity": 8.8, "slug": "live-composer-page-builder", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.1.18"}, "RULE-CVE-2026-1651-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:handler", "type": "equals", "value": "workflows"}, {"name": "ARGS:method", "type": "equals", "value": "update_status"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|[0-9]+[)]+[ ]*(?:AND|OR|UNION)[ ]|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|IF[ ]*[(].*,.*,|LOAD_FILE|INTO[ ]+(?:OUTFILE|DUMPFILE))~i"}], "cve": "CVE-2026-1651", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1651", "description": "Email Subscribers & Newsletters <=5.9.16 authenticated (Administrator+) SQL injection via workflow_ids in data parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "email-subscribers", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.9.16"}, "RULE-CVE-2026-16534-01": {"ajax_action": "acui_import_users_batch", "conditions": [{"name": "", "type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-16534", "description": "Import and export users and customers <2.4.2 privilege escalation via missing promote_users check on CSV import role assignment (acui_import_users_batch)", "mode": "block", "slug": "import-users-from-csv-with-meta", "target": "plugin", "versions": "<2.4.2"}, "RULE-CVE-2026-16534-02": {"ajax_action": "acui_import_users_batch", "conditions": [{"name": "", "type": "missing_capability", "value": "edit_user"}], "cve": "CVE-2026-16534", "description": "Import and export users and customers <2.4.2 account takeover via missing edit_user check on existing-user password/email overwrite during CSV import (acui_import_users_batch)", "mode": "block", "slug": "import-users-from-csv-with-meta", "target": "plugin", "versions": "<2.4.2"}, "RULE-CVE-2026-1655-01": {"ajax_action": "ep_save_frontend_event_submission", "conditions": [{"name": "ARGS:event_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1655", "description": "EventPrime <=4.2.8.4 missing authorization on ep_save_frontend_event_submission allows subscriber+ arbitrary event modification via event_id IDOR", "mode": "block", "severity": 4.3, "slug": "eventprime-event-calendar-management", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.2.8.4"}, "RULE-CVE-2026-1656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpbdp_ajax"}, {"name": "ARGS:listing_id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"name": "ARGS:/listingfields|listing_fields|fields/", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1656", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1656", "description": "Business Directory Plugin <=6.4.20 unauthenticated arbitrary listing modification via wpbdp_ajax AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "business-directory-plugin", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.4.20"}, "RULE-CVE-2026-16562-01": {"ajax_action": "wp_statistics_update_post_type_db", "conditions": [{"name": "ARGS:number_all", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-16562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16562", "description": "WP Statistics <14.16.10 missing capability check on wp_statistics_update_post_type_db AJAX handler allows subscriber+ unauthorized action trigger", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<14.16.10"}, "RULE-CVE-2026-16576-01": {"action": "admin_init", "conditions": [{"name": "ARGS:plugin_id", "type": "exists"}, {"name": "ARGS:plugin_info", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-16576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16576", "description": "Dokan (dokan-lite) <5.0.14 incorrect capability check allows Shop Manager role to install arbitrary plugins via setup wizard install_plugin flow", "mode": "block", "severity": 7.2, "slug": "dokan-lite", "tags": ["missing-authorization", "privilege-escalation", "plugin-installation", "authenticated"], "target": "plugin", "versions": "<5.0.14"}, "RULE-CVE-2026-16597-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~</script\\\\s*>\\\\s*<(?:script\\\\b|[a-zA-Z]+[^>]*\\\\bon[a-zA-Z]+\\\\s*=)~i"}], "cve": "CVE-2026-16597", "description": "GTM4WP <=1.22.3 unauthenticated stored XSS via WooCommerce guest checkout billing field script-tag breakout rendered unescaped in frontend dataLayer JSON", "mode": "block", "severity": 7.2, "slug": "duracelltomi-google-tag-manager", "target": "plugin", "versions": "<=1.22.3"}, "RULE-CVE-2026-1671-01": {"ajax_action": "winter_activity_log_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:page", "type": "regex", "value": "~^(?:wal_favouritelogs|wal_controlsecurity|wal_history|wal_usersessions|wal_reports|wal_logalerts|wal_disabledlogs|wal_cloudintegration|winteractivitylog)$~"}, {"name": "ARGS:function", "type": "regex", "value": "~^(?:datatable|datatable_saved|edit_log|edit_history|control_log|filter_get|filter_save|filter_remove|clear_all_log|bulk_remove)$~"}], "cve": "CVE-2026-1671", "method": "POST", "mode": "block", "severity": 6.5, "slug": "winterlock", "target": "plugin", "versions": "<1.2.9"}, "RULE-CVE-2026-16747-01": {"action": "init", "conditions": [{"name": "ARGS:_kirki_form", "type": "exists"}, {"name": "ARGS:_wpnonce", "type": "exists"}, {"name": "ARGS:/^(replyTo|name|subject|emailList)$/", "type": "regex", "value": "~\\\\[[a-zA-Z][a-zA-Z0-9_-]*(?:\\\\s[^\\\\]]*)?\\\\]~i"}], "cve": "CVE-2026-16747", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16747", "description": "Kirki <6.2.1 unauthenticated shortcode injection via front-end form submission fields leading to admin email disclosure and mail relay", "mode": "block", "severity": 6.5, "slug": "kirki", "tags": ["missing-authorization", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<6.2.1"}, "RULE-CVE-2026-1675-01": {"action": "init", "conditions": [{"name": "ARGS:OpenSesame", "type": "regex", "value": "~^0*1$~"}], "cve": "CVE-2026-1675", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1675", "description": "Advanced Country Blocker <=2.3.1 unauthenticated authorization bypass via insecure default secret key", "mode": "block", "severity": 5.3, "slug": "advanced-country-blocker", "tags": ["authorization-bypass", "insecure-default", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-16775-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[custom-facebook-feed\\\\b.{0,200}?(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|mouseenter|mouseout)\\\\s*=|javascript\\\\s*:|<iframe\\\\b|<svg\\\\b|<img\\\\b[^>]*onerror)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-16775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16775", "description": "Custom Facebook Feed <=4.9.0 stored XSS via unescaped \'id\' shortcode attribute injected in post content by contributor-level users", "mode": "block", "severity": 6.4, "slug": "custom-facebook-feed", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.9.0"}, "RULE-CVE-2026-16974-01": {"action": "init", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~&(?:lt;|#0*60;|#x0*3c;)\\\\s*(?:script|img|svg|iframe|body|object|embed)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-16974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-16974", "description": "Kirki <=6.2.0 contributor+ stored XSS via HTML-entity-encoded markup in comment field bypassing sanitize_text_field", "mode": "block", "severity": 6.4, "slug": "kirki", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-17037-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "kirki-comment"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:&(?:lt|#0*60|#x0*3c)[;]?\\\\s*(?:script\\\\b|[a-z][a-z0-9]*\\\\b[^&<>]{0,60}\\\\bon[a-zA-Z0-9_]+\\\\s*=)|<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-17037", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17037", "description": "Kirki <=6.2.0 stored XSS via HTML-entity-encoded script/event-handler payload in \'comment\' parameter on kirki-comment REST endpoint", "mode": "block", "severity": 7.2, "slug": "kirki", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-17037-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "kirki-comment"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:&(?:lt|#0*60|#x0*3c)[;]?\\\\s*(?:script\\\\b|[a-z][a-z0-9]*\\\\b[^&<>]{0,60}\\\\bon[a-zA-Z0-9_]+\\\\s*=)|<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-17037", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17037", "description": "Kirki <=6.2.0 stored XSS via HTML-entity-encoded script/event-handler payload in \'name\' parameter on kirki-comment REST endpoint", "mode": "block", "severity": 7.2, "slug": "kirki", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-1706-01": {"action": "init", "conditions": [{"name": "ARGS:vi", "type": "regex", "value": "~(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-1706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1706", "description": "All-in-One Video Gallery <=4.7.1 Reflected XSS via vi parameter in search form templates", "mode": "block", "severity": 6.1, "slug": "all-in-one-video-gallery", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-1708-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/appointments(/|\\\\?|$)~"}, {"name": "ARGS:append_where_sql", "type": "exists"}], "cve": "CVE-2026-1708", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1708", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated blind SQL injection via append_where_sql parameter in JSON body on REST /ssa/v1/appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api", "json-body-bypass"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-17086-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-17086", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17086", "description": "ShortPixel Image Optimiser <=6.5.5 PHP object injection via unsafe deserialization in Replacer::replaceContent (unserialize with allowed_classes=true)", "mode": "block", "severity": 8.8, "slug": "shortpixel-image-optimiser", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2026-17090-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:fl_builder_data", "type": "regex", "value": "~(?:</\\\\s*script|[\\"\']\\\\s*>\\\\s*<\\\\s*script|<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover)\\\\s*=\\\\s*[\\"\'])~i"}], "cve": "CVE-2026-17090", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17090", "description": "Beaver Builder Page Builder <=2.10.2.2 author+ stored XSS via Button module \'button\' (Button Code) setting due to insufficient output escaping; the exact settings-save AJAX action is unresolved in available artefacts (code_analyst.entrypoints[EP-FLBUILDER-AJAX-UNRESOLVED-SAVE], confidence 0.42, handler:null), so this rule scopes to the admin-ajax.php front controller and the evidenced fl_builder_data payload parameter and targets script/tag-breakout signatures rather than a fabricated action name", "mode": "block", "severity": 6.4, "slug": "beaver-builder-lite-version", "tags": ["stored-xss", "authenticated", "output-escaping"], "target": "plugin", "versions": "<=2.10.2.2"}, "RULE-CVE-2026-1714-01": {"ajax_action": "woolentor_suggest_price_action", "conditions": [{"name": "ARGS:send_to", "type": "regex", "value": "~[,;\\\\s]~"}], "cve": "CVE-2026-1714", "method": "POST", "mode": "block", "severity": 8.6, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1714-02": {"ajax_action": "woolentor_suggest_price_action", "conditions": [{"name": "ARGS:wlemail", "type": "regex", "value": "~(%0d|%0a|\\\\r|\\\\n)~i"}], "cve": "CVE-2026-1714", "method": "POST", "mode": "block", "severity": 8.6, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1720-01": {"ajax_action": "optn_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-1720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1720", "description": "WowOptin <=1.4.24 missing authorization on optn_install AJAX action allows Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "optin", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.24"}, "RULE-CVE-2026-1720-02": {"ajax_action": "optn_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-1720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1720", "description": "WowOptin <=1.4.24 missing authorization on optn_install_plugin AJAX action allows Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "optin", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.24"}, "RULE-CVE-2026-1750-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1750-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on user edit", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1750-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on user registration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-17505-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~#!trp(?:st|en)#~i"}], "cve": "CVE-2026-17505", "description": "TranslatePress <=3.2.5 unauthenticated reflected XSS via marker token smuggling in search parameter s", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2026-1754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "personal-authors-category"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php(?:%2[fF]|/)[^?]~i"}], "cve": "CVE-2026-1754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1754", "description": "Personal Authors Category <=0.3 reflected XSS via PHP_SELF path injection on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "personal-authors-category", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-17540-01": {"action": "init", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:file|zipdl|get|put|rm)$~i"}, {"type": "missing_capability", "value": "edit_files"}], "cve": "CVE-2026-17540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17540", "description": "File Manager <6.9.1 authenticated arbitrary file read/delete via unauthorized connector command dispatch", "mode": "block", "severity": 8.8, "slug": "file-manager", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-read", "arbitrary-file-delete", "authenticated"], "target": "plugin", "versions": "<6.9.1"}, "RULE-CVE-2026-1755-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_wp_attachment_image_alt", "type": "regex", "value": "~(?:<\\\\s*script|on(?:error|load|click|mouseover|focus|blur|input|change|submit|reset|keydown|keyup|keypress|dblclick|mousedown|mouseup|mouseenter|mouseleave|mousemove|mouseout)\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1755", "description": "Menu Icons by ThemeIsle <=0.13.20 Stored XSS via media attachment alt text (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "menu-icons", "tags": ["xss", "stored-xss", "media-upload"], "target": "plugin", "versions": "<=0.13.20"}, "RULE-CVE-2026-1755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/\\\\d+~"}, {"name": "ARGS:alt_text", "type": "regex", "value": "~(?:<\\\\s*script|on(?:error|load|click|mouseover|focus|blur|input|change|submit|reset|keydown|keyup|keypress|dblclick|mousedown|mouseup|mouseenter|mouseleave|mousemove|mouseout)\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1755", "description": "Menu Icons by ThemeIsle <=0.13.20 Stored XSS via REST API media alt_text update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "menu-icons", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=0.13.20"}, "RULE-CVE-2026-17576-01": {"action": "init", "conditions": [{"name": "ARGS:iwp_action", "type": "equals", "value": "get_comments"}, {"name": "ARGS_NAMES", "type": "regex", "value": "~iwp_get_comments_[^\']*\'~i"}], "cve": "CVE-2026-17576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-17576", "description": "InfiniteWP Client <=1.13.9 SQL injection via array-key names in get_comments signed remote-action JSON body", "mode": "block", "severity": 6.5, "slug": "iwp-client", "tags": ["sql-injection", "authenticated", "administrator-required", "remote-management"], "target": "plugin", "versions": "<=1.13.9"}, "RULE-CVE-2026-1781-01": {"action": "init", "conditions": [{"name": "ARGS:_mc4wp_action", "type": "equals", "value": "unsubscribe"}, {"name": "ARGS:_mc4wp_form_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-(admin|json)/|^/wp-login\\\\.php~"}], "cve": "CVE-2026-1781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1781", "description": "MC4WP: Mailchimp for WordPress <=4.11.1 unauthenticated arbitrary email unsubscribe via _mc4wp_action parameter override (partial: admin/API endpoints)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mailchimp-for-wp", "tags": ["missing-authorization", "unauthenticated", "action-override"], "target": "plugin", "versions": "<=4.11.1"}, "RULE-CVE-2026-1786-01": {"action": "init", "conditions": [{"name": "ARGS:/^dg_tw_options/", "type": "regex", "value": "~\\\\S~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1786", "method": "POST", "mode": "block", "severity": 6.5, "slug": "twitter-posts-to-blog", "target": "plugin", "versions": "<1.11.26"}, "RULE-CVE-2026-1787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/.*delete-migrated-data/tutor(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1787", "description": "LearnPress Export Import <=4.1.0 unauthenticated deletion of migrated course data via REST API delete-migrated-data/tutor endpoint", "method": "DELETE", "mode": "block", "severity": 4.8, "slug": "learnpress-import-export", "tags": ["missing-authorization", "unauthenticated", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2026-1792-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "ARGS:page", "type": "equals", "value": "GeoWidget"}], "cve": "CVE-2026-1792", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1792", "description": "GeoWidget <=1.0 reflected XSS via $_SERVER[\'PHP_SELF\'] on admin settings page", "mode": "block", "severity": 6.1, "slug": "geowidget", "tags": ["xss", "reflected", "php-self"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1793-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?:[\\\\w./\\\\\\\\-]*)?(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2026-1793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1793", "description": "Element Pack Addons for Elementor <=8.3.17 authenticated arbitrary file read via SVG Image widget path traversal", "method": "POST", "mode": "block", "severity": 6.5, "slug": "bdthemes-element-pack-lite", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=8.3.17"}, "RULE-CVE-2026-1796-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "stylebidet"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1796", "description": "StyleBidet <=1.0.0 reflected XSS via $_SERVER[\'PHP_SELF\'] on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "stylebidet", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1800-01": {"action": "init", "conditions": [{"name": "ARGS:fmcfIdSelectedFnt", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-1800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1800", "description": "Fonts Manager | Custom Fonts <=1.2 unauthenticated SQL injection via fmcfIdSelectedFnt parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "fonts-manager-custom-fonts", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2026-18021-01": {"ajax_action": "fl_builder_duplicate_wpml_layout", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-18021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18021", "description": "Beaver Builder Page Builder <=2.10.3.1 missing authorization on fl_builder_duplicate_wpml_layout AJAX handler allows layout duplication without a capability check", "mode": "block", "severity": 6.5, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.10.3.1"}, "RULE-CVE-2026-18039-01": {"action": "init", "conditions": [{"name": "ARGS:eael-register-submit", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor|author|shop_manager)$~i"}], "cve": "CVE-2026-18039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18039", "description": "Essential Addons for Elementor >=5.8.6 <6.7.2 unauthenticated privileged-role injection via front-end registration widget (register_user)", "mode": "block", "severity": 8.1, "slug": "essential-addons-for-elementor-lite", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": ">=5.8.6 <6.7.2"}, "RULE-CVE-2026-18039-02": {"ajax_action": "eael_lr_send_otp", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:administrator|editor|author|shop_manager)$~i"}], "cve": "CVE-2026-18039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18039", "description": "Essential Addons for Elementor >=5.8.6 <6.7.2 unauthenticated privileged-role injection via OTP registration send (eael_lr_send_otp)", "mode": "block", "severity": 8.1, "slug": "essential-addons-for-elementor-lite", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": ">=5.8.6 <6.7.2"}, "RULE-CVE-2026-1805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~damedia_giglist[^]]*list_title[ ]*=[ ]*[\\"\'][^]]*(<[a-zA-Z]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1805", "description": "DAMedia GigList <=1.9.0 Stored XSS via damedia_giglist shortcode list_title attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "damedia-giglist", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2026-1805-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~damedia_giglist[^]]*list_title[ ]*=[ ]*[\\"\'][^]]*(<[a-zA-Z]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1805", "description": "DAMedia GigList <=1.9.0 Stored XSS via damedia_giglist shortcode list_title attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "damedia-giglist", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2026-18051-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.|%2e|%252e){2}(?:[/\\\\\\\\]|%2f|%5c|%252f|%255c)~i"}], "cve": "CVE-2026-18051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18051", "description": "W3 Total Cache <2.10.5 unauthenticated arbitrary file write via unvalidated REQUEST_URI used to build page-cache file names, including .htaccess overwrite on Apache", "mode": "block", "severity": 10.0, "slug": "w3-total-cache", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "htaccess-overwrite"], "target": "plugin", "versions": "<2.10.5"}, "RULE-CVE-2026-18052-01": {"action": "init", "conditions": [{"name": "ARGS:auto_login", "type": "exists"}, {"name": "ARGS:message_id", "type": "exists"}, {"name": "ARGS:username", "type": "regex", "value": "~^(?:admin|administrator|root|superadmin)$~i"}], "cve": "CVE-2026-18052", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18052", "description": "ManageWP Worker <4.9.37 unauthenticated privilege escalation via unbound automatic-login signature (username substitution to privileged account)", "mode": "block", "severity": 8.1, "slug": "worker", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<4.9.37"}, "RULE-CVE-2026-1808-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ocplus_button\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript:|&lt;script|&#x3c;script)~i"}], "cve": "CVE-2026-1808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1808", "description": "Orange Confort+ <=0.7 Stored XSS via ocplus_button shortcode style attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orange-confort-plus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.7"}, "RULE-CVE-2026-1808-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ocplus_button\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript:|&lt;script|&#x3c;script)~i"}], "cve": "CVE-2026-1808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1808", "description": "Orange Confort+ <=0.7 Stored XSS via ocplus_button shortcode style attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orange-confort-plus", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.7"}, "RULE-CVE-2026-18080-01": {"action": "admin_init", "conditions": [{"name": "ARGS:role", "type": "exists"}, {"name": "ARGS:customer_id", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-18080", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18080", "description": "ERP - HR, Accounting & CRM Suite <=1.17.8 authenticated privilege escalation via unauthorized role assignment in CRM contact-to-WordPress-user conversion (erp_crm_make_wp_user)", "mode": "block", "severity": 9.8, "slug": "erp", "tags": ["missing-authorization", "privilege-escalation", "crm"], "target": "plugin", "versions": "<=1.17.8"}, "RULE-CVE-2026-1809-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via shortcode event handler attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1809-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via javascript: protocol in shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1809-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content[raw]", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via shortcode event handler attributes in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1809-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content[raw]", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via javascript: protocol in shortcode attributes in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-18100-01": {"action": "init", "conditions": [{"name": "ARGS:mf_form_id", "type": "exists"}, {"name": "ARGS:mf_form_id", "type": "regex", "value": "~^(?!\\\\s*[0-9]+\\\\s*$).+~"}], "cve": "CVE-2026-18100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18100", "description": "MetForm <=4.1.8 contributor+ stored XSS via non-numeric mf_form_id Elementor widget setting bypassing tag-based sanitization", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored", "authenticated", "input-validation"], "target": "plugin", "versions": "<=4.1.8"}, "RULE-CVE-2026-18109-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<svg[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18109", "description": "W3 Total Cache <=2.10.3 unauthenticated stored XSS via comment author name re-emitted through Lazy Load img attribute rewriting", "mode": "block", "slug": "w3-total-cache", "target": "plugin", "versions": "<=2.10.3"}, "RULE-CVE-2026-18146-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "fluentform_submit"}, {"name": "REQUEST_COOKIES:/.+/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18146", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18146", "description": "Fluent Forms <=6.2.11 unauthenticated stored XSS via cookie-derived Notification Smartcode values in fluentform_submit", "mode": "block", "severity": 7.2, "slug": "fluentform", "tags": ["stored-xss", "unauthenticated", "input-validation"], "target": "plugin", "versions": "<=6.2.11"}, "RULE-CVE-2026-1820-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bvmalt_sc_div_update_alt_text[^\\\\]]*post_id[^\\\\]]*(?:<script|<img|<iframe|<svg|<object|<embed|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1820", "description": "Media Library Alt Text Editor <=1.0.0 Stored XSS via bvmalt_sc_div_update_alt_text shortcode post_id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-library-alt-text-editor", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1820-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bvmalt_sc_div_update_alt_text[^\\\\]]*post_id[^\\\\]]*(?:<script|<img|<iframe|<svg|<object|<embed|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1820", "description": "Media Library Alt Text Editor <=1.0.0 Stored XSS via bvmalt_sc_div_update_alt_text shortcode post_id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-library-alt-text-editor", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1821-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[mt_(?:reservation|video|courses|form)[^\\\\]]*restkey\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1821", "description": "Microtango <=0.9.29 Stored XSS via restkey shortcode attribute in mt_reservation/mt_video", "method": "POST", "mode": "block", "severity": 6.4, "slug": "microtango", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.9.29"}, "RULE-CVE-2026-1821-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mt_(?:reservation|video|courses|form)[^\\\\]]*restkey\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1821", "description": "Microtango <=0.9.29 Stored XSS via restkey shortcode attribute in mt_reservation/mt_video (post_content)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "microtango", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.9.29"}, "RULE-CVE-2026-1824-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~infomaniak_connect_generic_auth_url.*?endpoint_login[ ]*=[ ]*[\\"\']?[ ]*(?:javascript|data|vbscript)[ ]*:~i"}], "cve": "CVE-2026-1824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1824", "description": "Infomaniak Connect OpenID <=1.0.2 Stored XSS via endpoint_login shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "infomaniak-connect-openid", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1825-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[syv\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\'\\"][^\\\\]]*(?:on[a-zA-Z]+=|<script|javascript:|</iframe)~i"}], "cve": "CVE-2026-1825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1825", "description": "Show YouTube Video <=1.1 Stored XSS via syv shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "show-youtube-video", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1826-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[order_qrcode[^\\\\]]*width\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img|<svg|<iframe)~i"}], "cve": "CVE-2026-1826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1826", "description": "OpenPOS Lite <=3.0 Stored XSS via order_qrcode shortcode width attribute in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpos-lite-version", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-1826-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[order_qrcode[^\\\\]]*width\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img|<svg|<iframe)~i"}], "cve": "CVE-2026-1826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1826", "description": "OpenPOS Lite <=3.0 Stored XSS via order_qrcode shortcode width attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpos-lite-version", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-1829-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~cvdb_content_visibility_check\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:system|passthru|exec|shell_exec|popen|proc_open|pcntl_exec|eval|assert|base64_decode|file_get_contents|file_put_contents|phpinfo|unlink|rmdir|mail|curl_exec|preg_replace|call_user_func|create_function|include|require)\\\\s*\\\\(~i"}], "cve": "CVE-2026-1829", "description": "Content Visibility for Divi Builder <=4.02 authenticated (Contributor+) RCE via cvdb_content_visibility_check shortcode attribute", "mode": "block", "severity": 8.8, "slug": "content-visibility-for-divi-builder", "target": "plugin", "versions": "<=4.02"}, "RULE-CVE-2026-1830-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/.*sync~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1830", "description": "Quick Playground <=1.3.1 unauthenticated sync code disclosure via REST API", "mode": "block", "severity": 9.8, "slug": "quick-playground", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-1830-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1830", "description": "Quick Playground <=1.3.1 unauthenticated arbitrary file upload via REST API with path traversal", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quick-playground", "tags": ["arbitrary-file-upload", "path-traversal", "remote-code-execution", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-18322-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:params[tpl][/sub_wp_create_user_role|reg_wp_create_user_role/]", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-18322", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18322", "description": "Smart Popup by Supsystic <=1.12.0 unauthenticated privilege escalation via elevated role injection in subscribe/register role parameter", "mode": "block", "severity": 8.8, "slug": "popup-by-supsystic", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.12.0"}, "RULE-CVE-2026-18323-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_form_~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18323", "description": "Forminator Forms <=1.57.0.2 unauthenticated stored XSS via radio field option-membership bypass in Save-and-Continue draft submission (forminator_submit_form_* AJAX action)", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["xss", "stored", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.57.0.2"}, "RULE-CVE-2026-18323-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_preview_form_~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-18323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18323", "description": "Forminator Forms <=1.57.0.2 unauthenticated stored XSS via radio field option-membership bypass in Save-and-Continue preview draft submission (forminator_submit_preview_form_* AJAX action)", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["xss", "stored", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.57.0.2"}, "RULE-CVE-2026-18324-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_(?:preview_)?form_~i"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*script\\\\b|<\\\\s*iframe\\\\b|<[^>]*\\\\bon[a-z]{3,15}\\\\s*=|(?:href|src|action|formaction)\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2026-18324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18324", "description": "Forminator Forms <=1.57.0.1 unauthenticated stored XSS - script/event-handler payload submitted through a form field and rendered unescaped in the admin entries view (fixed upstream by wp_kses_post() on output)", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["xss", "stored-xss", "unauthenticated", "rich-text-editor"], "target": "plugin", "versions": "<=1.57.0.1"}, "RULE-CVE-2026-1833-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wamate-phone-blocker"}, {"name": "ARGS:blocked_numbers", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1833", "description": "WaMate Confirm <=2.0.1 missing authorization on phone blocker settings page allows authenticated users to block/unblock phone numbers", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wamate-confirm", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1833-02": {"ajax_action": "grab_numbers_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1833", "description": "WaMate Confirm <=2.0.1 missing authorization on grab_numbers_action AJAX handler allows authenticated users to extract customer phone numbers", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wamate-confirm", "tags": ["missing-authorization", "broken-access-control", "data-exfiltration"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-18331-01": {"action": "init", "conditions": [{"name": "ARGS:frm_user_id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-18331", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18331", "description": "Formidable Forms <=6.33.1 unauthenticated stored XSS via frm_user_id privilege spoofing during entry submission", "mode": "block", "severity": 7.2, "slug": "formidable", "tags": ["xss", "stored", "unauthenticated", "privilege-spoofing"], "target": "plugin", "versions": "<=6.33.1"}, "RULE-CVE-2026-1834-01": {"ajax_action": "ive_ajax_save_template", "conditions": [{"name": "ARGS:template_data", "type": "regex", "value": "~<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1834", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1834", "description": "Ibtana Visual Editor <=1.2.5.7 stored XSS via ive_ajax_save_template template_data", "mode": "block", "severity": 6.4, "slug": "ibtana-visual-editor", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.2.5.7"}, "RULE-CVE-2026-18406-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/sureforms/v1/submit-form[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS", "type": "regex", "value": "~&(?:lt|#x?0*(?:3[cC]|60));?\\\\s*(?:script|img|svg|iframe|body|input)[\\\\s/>]~i"}], "cve": "CVE-2026-18406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18406", "description": "SureForms <=2.12.2 unauthenticated stored XSS via entity-encoded payload in submit-form REST endpoint", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.12.2"}, "RULE-CVE-2026-18406-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/sureforms/v1/submit-form[\\\\\\\\/]*$~i"}, {"name": "ARGS", "type": "regex", "value": "~&(?:lt|#x?0*(?:3[cC]|60));?\\\\s*(?:script|img|svg|iframe|body|input)[\\\\s/>]~i"}], "cve": "CVE-2026-18406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18406", "description": "SureForms <=2.12.2 unauthenticated stored XSS via entity-encoded payload in submit-form REST endpoint", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.12.2"}, "RULE-CVE-2026-1841-01": {"action": "init", "conditions": [{"name": "ARGS:pys_source", "type": "detectXSS"}], "cve": "CVE-2026-1841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1841", "description": "PixelYourSite <=11.2.0 stored XSS via unsanitized pys_source request parameter during checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=11.2.0"}, "RULE-CVE-2026-1841-02": {"action": "init", "conditions": [{"name": "ARGS:pys_landing", "type": "regex", "value": "~<[a-zA-Z/!]|javascript:~i"}], "cve": "CVE-2026-1841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1841", "description": "PixelYourSite <=11.2.0 stored XSS via unsanitized pys_landing request parameter during checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=11.2.0"}, "RULE-CVE-2026-1843-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]~i"}], "cve": "CVE-2026-1843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1843", "description": "Super Page Cache <=5.2.2 unauthenticated stored XSS via Activity Log - script tag injection", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-cloudflare-page-cache", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-18442-01": {"action": "init", "conditions": [{"name": "ARGS:/wcfmmp_store_search|wcfmmp_radius_range|wcfmmp_radius_lat|wcfmmp_radius_lng/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|<iframe[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|mouseenter|pointerover)\\\\s*=|javascript\\\\s*:|[\\"\'][^\\"\'>]{0,20}(?:on[a-zA-Z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2026-18442", "description": "WCFM Marketplace - Multivendor Marketplace for WooCommerce <=3.8.2 unauthenticated reflected XSS via store-list search and radius filter parameters", "mode": "block", "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<=3.8.2"}, "RULE-CVE-2026-18470-01": {"ajax_action": "xoo_el_form_action", "conditions": [{"name": "ARGS:_xoo_el_form", "type": "regex", "value": "~^lost[_-]?password$~i"}, {"name": "ARGS:user_login", "type": "exists"}], "cve": "CVE-2026-18470", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18470", "description": "Login & Register Forms (easy-login-woocommerce) <4.0.2 unauthenticated email address disclosure via xoo_el_form_action lost-password AJAX request", "mode": "block", "severity": 7.5, "slug": "easy-login-woocommerce", "tags": ["information-disclosure", "unauthenticated", "user-enumeration"], "target": "plugin", "versions": "<4.0.2"}, "RULE-CVE-2026-18488-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "wp:blocksy/dynamic-data"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"tagName\\"\\\\s*:\\\\s*\\"(?!(?:div|span|p|h[1-6])\\")[a-zA-Z0-9_-]*\\"~i"}], "cve": "CVE-2026-18488", "description": "Blocksy Companion <=2.1.51 stored XSS via tagName attribute in blocksy/dynamic-data block", "mode": "block", "slug": "blocksy-companion", "target": "plugin", "versions": "<=2.1.51"}, "RULE-CVE-2026-18547-01": {"action": "um_submit_form_profile", "conditions": [{"name": "ARGS:profile_nonce", "type": "exists"}, {"name": "ARGS:user_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\']\\\\s*(?:autofocus[^>]{0,60}onfocus\\\\s*=|onfocus\\\\s*=[^>]{0,60}autofocus)~i"}], "cve": "CVE-2026-18547", "description": "Ultimate Member <=2.12.1 authenticated (subscriber+) stored XSS via textarea profile field HTML-attribute breakout during profile form submission", "mode": "block", "slug": "ultimate-member", "target": "plugin", "versions": "<=2.12.1"}, "RULE-CVE-2026-1857-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kb-getresponse/v1/get(?:[/?&]|$)~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|&|\\\\?)endpoint=~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1857", "description": "Kadence Blocks <=3.6.1 authenticated (Contributor+) SSRF via endpoint parameter in GetResponse REST API route", "method": "GET", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["ssrf", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-1860-01": {"ajax_action": "kaliforms_form_delete_uploaded_file", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<script|</script|<img|onerror[[:space:]]*=|onload[[:space:]]*=|javascript:)~i"}], "cve": "CVE-2026-1860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1860", "description": "Kali Forms <= 2.4.7 Reflected XSS via id parameter in kaliforms_form_delete_uploaded_file AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "kali-forms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-1865-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_~"}, {"name": "ARGS:membership_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+)~i"}], "cve": "CVE-2026-1865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1865", "description": "User Registration & Membership <=5.1.2 authenticated (Subscriber+) SQL injection via membership_ids[] in membership AJAX handlers", "mode": "block", "severity": 6.5, "slug": "user-registration", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1866-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "regex", "value": "~(?:&amp;|&#0*38;|&#x0*26;)(lt|gt|quot|amp|apos|#0*\\\\d{2,5}|#x[0-9a-fA-F]+);~i"}], "cve": "CVE-2026-1866", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2026-1866-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "regex", "value": "~(?:&amp;|&#0*38;|&#x0*26;)(lt|gt|quot|amp|apos|#0*\\\\d{2,5}|#x[0-9a-fA-F]+);~i"}], "cve": "CVE-2026-1866", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2026-1867-01": {"ajax_action": "fe_get_formBuilder_data", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1867", "description": "Front Editor <5.0.6 sensitive form data disclosure via fe_get_formBuilder_data AJAX action", "mode": "block", "severity": 5.9, "slug": "front-editor", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<5.0.6"}, "RULE-CVE-2026-1867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/bfe/v1/form(?:/[0-9]+)?(?:[?&].*)?$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1867", "description": "Front Editor <5.0.6 sensitive form data disclosure via unauthenticated GET access to REST /bfe/v1/form endpoint", "mode": "block", "severity": 5.9, "slug": "front-editor", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<5.0.6"}, "RULE-CVE-2026-1870-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/thim-ekit/archive-course/get-courses(?:[/?&]|$)~"}, {"name": "ARGS:params_url[post_status]", "type": "regex", "value": "~^(?:private|draft|pending|trash|auto-draft|future|inherit)$~i"}, {"name": "ARGS:atts", "type": "regex", "value": "~.+~"}], "cve": "CVE-2026-1870", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1870", "description": "Thim Elementor Kit <=1.3.7 unauthenticated information disclosure of private/draft LearnPress courses via post_status in params_url on REST endpoint", "mode": "block", "severity": 5.3, "slug": "thim-elementor-kit", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2026-18781-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:upload_name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[.\\\\x00 ]|$)~i"}], "cve": "CVE-2026-18781", "description": "Drag and Drop Multiple File Upload for Contact Form 7 <1.3.9.9 unauthenticated arbitrary code execution via dangerous-extension filename bypass in upload_name parameter of dnd_codedropz_upload AJAX handler", "mode": "block", "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "target": "plugin", "versions": "<1.3.9.9"}, "RULE-CVE-2026-1885-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sswp-slide\\\\b[^\\\\]]*sswpid\\\\s*=\\\\s*[\\"\']?\\\\s*[0-9]*\\\\s*[^0-9\\"\'\\\\]\\\\s][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1885", "description": "Slideshow WP <=1.1 Stored XSS via non-numeric sswpid attribute in sswp-slide shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slideshow-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-18855-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:link_library_user_link_submission", "type": "exists"}, {"name": "ARGS:link_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-18855", "description": "Link Library <=7.9.4 unauthenticated arbitrary file deletion via path traversal in link_url on front-end link submission", "mode": "block", "severity": 9.1, "slug": "link-library", "target": "plugin", "versions": "<=7.9.4"}, "RULE-CVE-2026-1888-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[docusplaylist\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1888", "description": "Docus \\u2013 YouTube Video Playlist <=1.0.6 Stored XSS via [docusplaylist] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "docus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-1888-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[docusplaylist\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1888", "description": "Docus \\u2013 YouTube Video Playlist <=1.0.6 Stored XSS via [docusplaylist] shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "docus", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-1893-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[orbisius_random_name_generator\\\\b[^\\\\]]*btn_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1893", "description": "Orbisius Random Name Generator <=1.0.2 Stored XSS via btn_label shortcode attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orbisius-random-name-generator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1893-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[orbisius_random_name_generator\\\\b[^\\\\]]*btn_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1893", "description": "Orbisius Random Name Generator <=1.0.2 Stored XSS via btn_label shortcode attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orbisius-random-name-generator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-18978-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~data-settings\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*&#(?:0*(?:34|39|60|62)|x0*(?:22|27|3c|3e));~i"}], "cve": "CVE-2026-18978", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-18978", "description": "LiteSpeed Cache <=7.8.1 unauthenticated stored XSS via numeric-entity (decimal or hex) encoded data-settings payload in comment content", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["xss", "stored-xss", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=7.8.1"}, "RULE-CVE-2026-18983-01": {"action": "personal_options_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 missing upload_files capability check on personal_options_update avatar upload branch", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-18983-02": {"action": "personal_options_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"name": "FILES:wpua-file:name", "type": "regex", "value": "~^(?!.*\\\\.(?:jpe?g|gif|png|webp|avif|heic)$).*$~i"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 unrestricted file upload via MIME type bypass in wpua_action_process_option_update (personal_options_update) allowing non-image extensions such as dxfp", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-18983-03": {"action": "edit_user_profile_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 missing upload_files capability check on edit_user_profile_update avatar upload branch", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-18983-04": {"action": "edit_user_profile_update", "conditions": [{"name": "FILES:wpua-file", "type": "exists"}, {"name": "FILES:wpua-file:name", "type": "regex", "value": "~^(?!.*\\\\.(?:jpe?g|gif|png|webp|avif|heic)$).*$~i"}], "cve": "CVE-2026-18983", "description": "One User Avatar <=2.5.4 unrestricted file upload via MIME type bypass in wpua_action_process_option_update (edit_user_profile_update) allowing non-image extensions such as dxfp", "mode": "block", "severity": 7.5, "slug": "one-user-avatar", "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2026-1900-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper(?:-[a-z0-9-]+)?/v[0-9]+/[a-z0-9_/-]*(?:setting|option|config|update|save)~i"}, {"name": "ARGS:settings.keywords", "type": "regex", "value": "~(?:hacked|injected|evil|malware|<script|onerror=|onload=)~i"}, {"name": "ARGS:settings.url", "type": "regex", "value": "~(?:evil|malware|attacker|payload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1900", "description": "Link Whisper <=0.9.0 unauthenticated settings modification via REST API", "mode": "block", "severity": 6.5, "slug": "link-whisper", "target": "plugin", "versions": "<=0.9.0"}, "RULE-CVE-2026-1902-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[hp-calendar-manage-redirect[^\\\\]]*apix\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>();\\\\\\\\`]|[^\\\\s\\\\]]*[<>();\\\\\\\\`])~i"}], "cve": "CVE-2026-1902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1902", "description": "Hammas Calendar <1.5.12 Stored XSS via apix shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "hammas-calendar", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<1.5.12"}, "RULE-CVE-2026-1903-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sb_ravelry_designs\\\\b[^\\\\]]*layout\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>=()\\\\\\\\]|[\\"\'][^\\"\']*[\\"\'][><])~i"}], "cve": "CVE-2026-1903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1903", "description": "Ravelry Designs Widget <=1.0.0 Stored XSS via sb_ravelry_designs shortcode layout attribute in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ravelry-designs-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1903-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sb_ravelry_designs\\\\b[^\\\\]]*layout\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>=()\\\\\\\\]|[\\"\'][^\\"\']*[\\"\'][><])~i"}], "cve": "CVE-2026-1903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1903", "description": "Ravelry Designs Widget <=1.0.0 Stored XSS via sb_ravelry_designs shortcode layout attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ravelry-designs-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1905-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~show_sphere_image[^\\\\]]*width\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*on\\\\w+\\\\s*=|<\\\\s*script|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-1905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1905", "description": "Sphere Manager <=1.0.2 Stored XSS via show_sphere_image shortcode width attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sphere-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1905-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~show_sphere_image[^\\\\]]*width\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*on\\\\w+\\\\s*=|<\\\\s*script|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-1905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1905", "description": "Sphere Manager <=1.0.2 Stored XSS via show_sphere_image shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sphere-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wavesurfer\\\\b[^\\\\]]*\\\\b(?:src|ogg)\\\\s*=\\\\s*(?:(?:\\"[^\\"]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"]*\\")|(?:\'[^\']*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\']*\')|(?:[^\\\\s\\\\]]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1909", "description": "WaveSurfer-WP <=2.8.3 Stored XSS via [wavesurfer] shortcode src attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wavesurfer-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2026-1909-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wavesurfer\\\\b[^\\\\]]*\\\\b(?:src|ogg)\\\\s*=\\\\s*(?:(?:\\"[^\\"]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"]*\\")|(?:\'[^\']*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\']*\')|(?:[^\\\\s\\\\]]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1909", "description": "WaveSurfer-WP <=2.8.3 Stored XSS via [wavesurfer] shortcode src attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wavesurfer-wp", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2026-19092-01": {"ajax_action": "tutor_render_lesson_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:phpinfo|phpversion|php_uname|get_defined_vars|php_sapi_name|getcwd|get_current_user|phpcredits|session_start|opcache_reset|get_loaded_extensions|memory_get_usage|memory_get_peak_usage|error_get_last|apache_get_modules)$~i"}], "cve": "CVE-2026-19092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19092", "description": "Tutor LMS <4.0.6 unauthenticated arbitrary zero-argument PHP function invocation via tutor_render_lesson_content request data", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["unauthenticated", "injection", "arbitrary-function-invocation"], "target": "plugin", "versions": "<4.0.6"}, "RULE-CVE-2026-19092-02": {"ajax_action": "tutor_course_add_to_wishlist", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^(?:phpinfo|phpversion|php_uname|get_defined_vars|php_sapi_name|getcwd|get_current_user|phpcredits|session_start|opcache_reset|get_loaded_extensions|memory_get_usage|memory_get_peak_usage|error_get_last|apache_get_modules)$~i"}], "cve": "CVE-2026-19092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19092", "description": "Tutor LMS <4.0.6 unauthenticated arbitrary zero-argument PHP function invocation via tutor_course_add_to_wishlist request data", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["unauthenticated", "injection", "arbitrary-function-invocation"], "target": "plugin", "versions": "<4.0.6"}, "RULE-CVE-2026-1910-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[upmenu-menu[^\\\\]]*lang[^\\\\]]*(?:<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 Stored XSS via lang attribute of upmenu-menu shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1910-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[upmenu-menu[^\\\\]]*lang[^\\\\]]*(?:<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 Stored XSS via lang attribute of upmenu-menu shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1910-03": {"ajax_action": "ajaxUpdateOption", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 unauthenticated arbitrary option update via ajaxUpdateOption AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["missing-authorization", "unauthenticated", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1912-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ctdoi\\\\s+[^\\\\]]*code\\\\s*=\\\\s*[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1912", "description": "Citations Tools <=0.3.2 Contributor+ stored XSS via ctdoi shortcode code attribute in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "citations-tools", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.3.2"}, "RULE-CVE-2026-1912-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ctdoi\\\\s+[^\\\\]]*code\\\\s*=\\\\s*[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1912", "description": "Citations Tools <=0.3.2 Contributor+ stored XSS via ctdoi shortcode code attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "citations-tools", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=0.3.2"}, "RULE-CVE-2026-1915-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[plyr[^a-zA-Z0-9_][^\\\\]]*poster[ ]*=[ ]*[\'\\"][^\\\\]]*(?:<[a-z]|on[a-z]+=|javascript:|data:text/html)~i"}], "cve": "CVE-2026-1915", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1915", "description": "Simple Plyr <=0.0.1 Stored XSS via poster attribute in [plyr] shortcode (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-plyr", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.0.1"}, "RULE-CVE-2026-1915-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[plyr[^a-zA-Z0-9_][^\\\\]]*poster[ ]*=[ ]*[\'\\"][^\\\\]]*(?:<[a-z]|on[a-z]+=|javascript:|data:text/html)~i"}], "cve": "CVE-2026-1915", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1915", "description": "Simple Plyr <=0.0.1 Stored XSS via poster attribute in [plyr] shortcode (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-plyr", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.0.1"}, "RULE-CVE-2026-1922-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ecs-list-events\\\\b[^\\\\]]*message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<iframe|<svg|<object|<embed|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1922", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1922", "description": "The Events Calendar Shortcode & Block <=3.1.2 authenticated stored XSS via ecs-list-events shortcode message attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-events-calendar-shortcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-1922-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ecs-list-events\\\\b[^\\\\]]*message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<iframe|<svg|<object|<embed|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1922", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1922", "description": "The Events Calendar Shortcode & Block <=3.1.2 authenticated stored XSS via ecs-list-events shortcode message attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-events-calendar-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-19221-01": {"action": "admin_init", "conditions": [{"name": "ARGS:hub_connector_callback", "type": "exists"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector setting insufficiently restricted to network administrators on multisite via process_auth_callback", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "broken-access-control"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/hub-connector/v1/sync[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector sync REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/hub-connector/v1/sync[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector sync REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/hub-connector/v1/logout[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector logout REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19221-05": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/hub-connector/v1/logout[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19221", "description": "Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector logout REST endpoint insufficiently restricted to network administrators on multisite", "mode": "block", "severity": 7.2, "slug": "forminator", "tags": ["missing-authorization", "privilege-escalation", "multisite", "rest-api"], "target": "plugin", "versions": ">=1.40.0 <1.57.0.5"}, "RULE-CVE-2026-19222-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~\\"registration-role-field\\"\\\\s*:\\\\s*\\"(?:administrator|editor|shop_manager|author)\\"~i"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2026-19222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19222", "description": "Forminator Forms <1.57.0.7 improper privilege management allows form builders lacking create_users to assign the administrator role via forminator_save_builder registration settings", "mode": "block", "severity": 6.6, "slug": "forminator", "tags": ["privilege-escalation", "improper-authorization", "authenticated"], "target": "plugin", "versions": "<1.57.0.7"}, "RULE-CVE-2026-19223-01": {"ajax_action": "smush_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19223", "description": "Smush <4.3.2 site administrator can save network-wide plugin settings without network administrator capability via smush_save_settings AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-smushit", "tags": ["missing-authorization", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<4.3.2"}, "RULE-CVE-2026-19223-02": {"ajax_action": "reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_network_options"}], "cve": "CVE-2026-19223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19223", "description": "Smush <4.3.2 site administrator can reset network-wide plugin settings without network administrator capability via reset_settings AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-smushit", "tags": ["missing-authorization", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<4.3.2"}, "RULE-CVE-2026-1925-01": {"ajax_action": "emailkit_update_template_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1925", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1925", "description": "EmailKit <=1.6.2 missing authorization on emailkit_update_template_data AJAX handler allows subscriber+ post modification", "mode": "block", "severity": 4.3, "slug": "emailkit", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2026-1927-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/figma_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated information disclosure via GET /greenshift/v1/figma_settings/ REST endpoint missing authorization", "method": "GET", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1927-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/license_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated information disclosure via GET /greenshift/v1/license_settings/ REST endpoint missing authorization", "method": "GET", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1927-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/figma_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated unauthorized settings update via POST /greenshift/v1/figma_settings/ REST endpoint missing authorization", "method": "POST", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1929-01": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|assert|eval|call_user_func|call_user_func_array|preg_replace|create_function|file_put_contents|file_get_contents|fwrite|fopen|include|require|include_once|require_once|unlink|rmdir|chmod|chown|curl_exec|mail|header|phpinfo|ob_start|register_shutdown_function|wp_insert_user|wp_set_password|update_option|delete_option|array_map|array_filter|array_walk|usort|uasort|uksort)$~i"}], "cve": "CVE-2026-1929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1929", "description": "Advanced Woo Labels <=2.36 authenticated (Contributor+) RCE via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "advanced-woo-labels", "tags": ["code-injection", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-1931-01": {"ajax_action": "propertysearch", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1931-02": {"ajax_action": "floorplansearch", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1931-03": {"ajax_action": "rentfetch_track_search_view", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1932-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookr/v1/appointments(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1932", "description": "Bookr <=1.0.2 unauthenticated appointment status modification via REST API (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "bookr", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1932-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookr/v1/appointments(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1932", "description": "Bookr <=1.0.2 unauthenticated appointment status modification via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "bookr", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1937-01": {"ajax_action": "yaymail_import_state", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1937", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/delete(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/delete REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/activate(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/activate REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/update(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/update REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_events\\\\b[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/])[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1941", "description": "WP Event Aggregator <1.9.0 authenticated (contributor+) stored XSS via [wp_events] shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-event-aggregator", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<1.9.0"}, "RULE-CVE-2026-1941-02": {"ajax_action": "wpea_load_paged_events", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-1941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1941", "description": "WP Event Aggregator <1.9.0 unauthenticated reflected XSS via shortcode_args in wpea_load_paged_events AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-event-aggregator", "tags": ["xss", "reflected", "ajax", "unauthenticated"], "target": "plugin", "versions": "<1.9.0"}, "RULE-CVE-2026-1942-01": {"ajax_action": "b2s_curation_draft", "conditions": [{"name": "ARGS:b2s-draft-id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1942", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "target": "plugin", "versions": "<=8.7.4"}, "RULE-CVE-2026-1942-02": {"ajax_action": "b2s_curation_share", "conditions": [{"name": "ARGS:b2s-draft-id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1942", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "target": "plugin", "versions": "<=8.7.4"}, "RULE-CVE-2026-19423-01": {"action": "init", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|shop_manager|um_administrator)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19423", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19423", "description": "Ultimate Member >=2.6.7 <2.13.0 unauthenticated privilege escalation via submitted role field on registration/profile form", "mode": "block", "severity": 8.1, "slug": "ultimate-member", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": ">=2.6.7 <2.13.0"}, "RULE-CVE-2026-1943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail/v1/templates(/|\\\\?|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via REST template update (rich_text in template_elements)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1943-02": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via AJAX template import (yaymail_import_templates)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1943-03": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via AJAX state import (yaymail_import_state)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1944-01": {"ajax_action": "cbk_save_v1", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1944", "description": "CallbackKiller Service Widget <=1.2 missing authorization on cbk_save_v1 AJAX action allows unauthenticated site ID modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "callbackkiller-service-widget", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2026-1945-01": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:wpb_user_name", "type": "regex", "value": "~<[^>]*>|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1945", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1945", "description": "WPBookit <=1.0.8 unauthenticated stored XSS via wpb_user_name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpbookit", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1945-02": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:wpb_user_email", "type": "regex", "value": "~<[^>]*>|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1945", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1945", "description": "WPBookit <=1.0.8 unauthenticated stored XSS via wpb_user_email parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpbookit", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1947-01": {"ajax_action": "submit_nex_form", "conditions": [{"name": "ARGS:nf_set_entry_update_id", "type": "exists"}], "cve": "CVE-2026-1947", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1947", "description": "NEX-Forms <=9.1.9 unauthenticated arbitrary form entry overwrite via IDOR in submit_nex_form (nf_set_entry_update_id)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "nex-forms-express-wp-form-builder", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=9.1.9"}, "RULE-CVE-2026-1948-01": {"ajax_action": "deactivate_license", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1948", "description": "NEX-Forms <=9.1.9 missing authorization on deactivate_license AJAX handler allows Subscriber+ license deactivation", "mode": "block", "severity": 4.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.1.9"}, "RULE-CVE-2026-19598-01": {"ajax_action": "pods_admin", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_admin"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Pods authorization bypass (CWE-863) reachable unauthenticated via wp_ajax_nopriv_pods_admin. PodsAdmin::admin_ajax() enforces its method allowlist, login check, nonce check and pods_is_admin() capability gate exclusively through pods_error(). In the affected versions pods_error() takes a \\"json\\" error mode whenever wp_is_json_request() is true, and in that mode the meta-box-loader compatibility branch only writes the failure to the PHP error log and returns false instead of terminating the request. Every guard therefore becomes non-terminating and execution falls through to call_user_func([$api, $method]), letting an unauthenticated attacker reach PodsAPI methods such as save_pod - escalating to Administrator or overwriting any user\'s password. Fixed in 3.3.9.1 (and per-branch backports) by adding check_admin_referer(\'meta-box-loader\', \'meta-box-loader-nonce\') to that branch.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19598-02": {"ajax_action": "pods_admin_components", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_admin_components"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Same pods_error() authorization-bypass fuse as RULE-CVE-2026-19598-01, reached through wp_ajax_nopriv_pods_admin_components. PodsComponents::admin_ajax() gates the component method allowlist and its \'pods-component-<component>-<method>\' nonce check solely through pods_error(); under the meta-box-loader compatibility path pods_error() returns false instead of terminating, so an unauthenticated request falls through to the component handler.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19598-03": {"ajax_action": "pods_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_upload"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Same pods_error() authorization-bypass fuse as RULE-CVE-2026-19598-01, reached through wp_ajax_nopriv_pods_upload. PodsField_File::admin_ajax_upload() enforces its method allowlist and the current_user_can(\'upload_files\') check only via pods_error(); under the meta-box-loader compatibility path pods_error() returns false instead of terminating, exposing the Pods upload handler to unauthenticated callers.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19598-04": {"ajax_action": "pods_relationship", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pods_relationship"}, {"name": "ARGS:meta-box-loader", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-19598", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19598", "description": "Same pods_error() authorization-bypass fuse as RULE-CVE-2026-19598-01, reached through wp_ajax_nopriv_pods_relationship. PodsField_Pick::admin_ajax_relationship() enforces its required-parameter check and wp_verify_nonce() only via pods_error(); under the meta-box-loader compatibility path pods_error() returns false instead of terminating, so an unauthenticated caller reaches the relationship data handler.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "pods", "tags": ["unauthenticated", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": ">=2.8 <=2.8.23.3 || >=2.9 <=2.9.19.3 || >=3.0 <=3.0.10.3 || >=3.1 <=3.1.4.1 || >=3.2 <=3.2.8.2 || >=3.3 <=3.3.9"}, "RULE-CVE-2026-19615-02": {"action": "rest_insert_attachment", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-19615", "description": "Admin and Site Enhancements (ASE) <9.0.1 stored XSS via unsanitised SVG upload through REST attachment insertion", "mode": "block", "slug": "admin-site-enhancements", "target": "plugin", "versions": "<9.0.1"}, "RULE-CVE-2026-19632-01": {"ajax_action": "trp_get_translations_regular", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19632", "description": "TranslatePress <=3.3.1 unauthenticated sensitive information disclosure via trp_get_translations_regular AJAX action", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2026-19718-01": {"ajax_action": "bvadm", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19718", "description": "MalCare Security / BlogVault Backup & Staging / WP Remote <6.65 unauthenticated disclosure of remote-management secret-derived data via bvadm AJAX action (CWE-287)", "mode": "block", "severity": 8.1, "slug": "malcare-security", "tags": ["missing-authorization", "authentication-bypass", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<6.65"}, "RULE-CVE-2026-19722-01": {"ajax_action": "wpvivid_restore", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via backup_id in wpvivid_restore leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19722-02": {"ajax_action": "wpvivid_restore", "conditions": [{"name": "ARGS:restore_options", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via restore_options in wpvivid_restore leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19722-03": {"ajax_action": "wpvivid_do_restore_2", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via backup_id in wpvivid_do_restore_2 leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19722-04": {"ajax_action": "wpvivid_do_restore_2", "conditions": [{"name": "ARGS:restore_options", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|^[A-Za-z]:[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-19722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19722", "description": "WPvivid Backup, Migration & Staging <0.9.133 admin+ path traversal via restore_options in wpvivid_do_restore_2 leading to arbitrary file write during restoration", "mode": "block", "severity": 6.6, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "arbitrary-file-write", "authenticated", "backup-restore"], "target": "plugin", "versions": "<0.9.133"}, "RULE-CVE-2026-19725-01": {"ajax_action": "wpvivid_restore", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|%2e%2e|%2f|%5c)~i"}], "cve": "CVE-2026-19725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19725", "description": "WPvivid Backup, Migration & Staging <0.9.131 unauthenticated log file path traversal via backup_id in wpvivid_restore AJAX action", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "unauthenticated", "arbitrary-file-write", "cwe-22"], "target": "plugin", "versions": "<0.9.131"}, "RULE-CVE-2026-19725-02": {"ajax_action": "wpvivid_get_restore_progress", "conditions": [{"name": "ARGS:backup_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^[\\\\\\\\/]|%2e%2e|%2f|%5c)~i"}], "cve": "CVE-2026-19725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19725", "description": "WPvivid Backup, Migration & Staging <0.9.131 unauthenticated log file path traversal via backup_id in wpvivid_get_restore_progress AJAX action", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "tags": ["path-traversal", "unauthenticated", "arbitrary-file-write", "cwe-22"], "target": "plugin", "versions": "<0.9.131"}, "RULE-CVE-2026-19769-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-19769", "description": "Ninja Forms <=3.15.1 unauthenticated stored XSS via repeater child key confusion in nf_ajax_submit formData", "mode": "block", "severity": 7.2, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.15.1"}, "RULE-CVE-2026-1980-01": {"ajax_action": "wpb_ajax_get", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "get_customer_list"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1980", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1980", "description": "WPBookit <=1.0.8 unauthenticated sensitive customer data exposure via get_customer_list route", "mode": "block", "severity": 5.3, "slug": "wpbookit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1981-01": {"ajax_action": "winston_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_disconnect AJAX handler allows subscriber+ API disconnection", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1981-02": {"ajax_action": "winston_link_website", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_link_website AJAX handler allows subscriber+ site linking", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1981-03": {"ajax_action": "winston_verify_website", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_verify_website AJAX handler allows subscriber+ site verification", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1983-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "seatt"}, {"name": "ARGS:remove_event", "type": "regex", "value": "~.+~"}, {"name": "ARGS:event_id", "type": "regex", "value": "~^[0-9]+$~"}], "cve": "CVE-2026-1983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1983", "description": "Simple Event Attendance <=1.5.0 CSRF vulnerability allowing unauthenticated event deletion via forged requests", "method": "GET", "mode": "block", "severity": 4.3, "slug": "simple-event-attendance", "tags": ["csrf", "missing-authorization", "unauthenticated", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-19848-01": {"ajax_action": "pp_ajax_signup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[\\\\/?[a-zA-Z][a-zA-Z0-9_-]{0,30}(?:\\\\s[^\\\\[\\\\]]{0,200})?\\\\]~"}], "cve": "CVE-2026-19848", "description": "ProfilePress (wp-user-avatar) <4.17.1 unauthenticated stored shortcode injection via pp_ajax_signup registration fields", "mode": "block", "slug": "wp-user-avatar", "target": "plugin", "versions": "<4.17.1"}, "RULE-CVE-2026-19848-02": {"ajax_action": "pp_ajax_editprofile", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[\\\\/?[a-zA-Z][a-zA-Z0-9_-]{0,30}(?:\\\\s[^\\\\[\\\\]]{0,200})?\\\\]~"}], "cve": "CVE-2026-19848", "description": "ProfilePress (wp-user-avatar) <4.17.1 authenticated stored shortcode injection via pp_ajax_editprofile profile field update", "mode": "block", "slug": "wp-user-avatar", "target": "plugin", "versions": "<4.17.1"}, "RULE-CVE-2026-1985-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~press3d[/\\\\\\\\]model[^}]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1985", "description": "Press3D <=1.0.2 authenticated (Author+) stored XSS via javascript: URI in 3D Model block linkUrl attribute via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "press3d", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-19855-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[[a-zA-Z_][a-zA-Z0-9_-]*(?:\\\\s+[a-zA-Z_][a-zA-Z0-9_=\\"\'\\\\s]*)?\\\\]~i"}], "cve": "CVE-2026-19855", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19855", "description": "CleanTalk Spam Protect <6.87 unauthenticated shortcode injection via wp-comments-post.php comment content", "mode": "block", "severity": 6.5, "slug": "cleantalk-spam-protect", "tags": ["shortcode-injection", "unauthenticated", "stored-injection"], "target": "plugin", "versions": "<6.87"}, "RULE-CVE-2026-1987-01": {"ajax_action": "scheduler_widget_save_event", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987", "description": "Scheduler Widget <=0.1.6 IDOR allows Subscriber+ to modify arbitrary events via scheduler_widget_save_event AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "scheduler-widget", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.1.6"}, "RULE-CVE-2026-1987-02": {"ajax_action": "scheduler_widget_delete_event", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987", "description": "Scheduler Widget <=0.1.6 IDOR allows Subscriber+ to delete arbitrary events via scheduler_widget_delete_event AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "scheduler-widget", "tags": ["idor", "missing-authorization", "broken-access-control", "unauthorized-deletion"], "target": "plugin", "versions": "<=0.1.6"}, "RULE-CVE-2026-1988-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|[%]2[eE][%]2[eE][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:php|phar|data|expect|zip)(?:://|[%]3[aA][%]2[fF][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute (PHP wrapper variant)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|[%]2[eE][%]2[eE][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute in content field", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:php|phar|data|expect|zip)(?:://|[%]3[aA][%]2[fF][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute in content field (PHP wrapper variant)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-19883-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpematico-action", "type": "equals", "value": "import_settings"}, {"name": "FILES:txtsettings", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19883", "description": "WPeMatico RSS Feed Fetcher <=2.8.24 missing capability check on wpematico_import_settings allows subscriber-level arbitrary option update and privilege escalation", "mode": "block", "slug": "wpematico", "target": "plugin", "versions": "<=2.8.24"}, "RULE-CVE-2026-19883-02": {"ajax_action": "process_button_click", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-19883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19883", "description": "WPeMatico RSS Feed Fetcher <=2.8.24 missing capability check on process_button_click AJAX handler allows unauthenticated option toggle", "mode": "block", "slug": "wpematico", "target": "plugin", "versions": "<=2.8.24"}, "RULE-CVE-2026-1993-01": {"ajax_action": "exactmetrics_vue_update_settings", "conditions": [{"name": "ARGS:setting", "type": "equals", "value": "save_settings"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings save_settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-02": {"ajax_action": "exactmetrics_vue_update_settings", "conditions": [{"name": "ARGS:setting", "type": "equals", "value": "view_reports"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings view_reports", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-04": {"ajax_action": "exactmetrics_vue_update_settings_bulk", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~save_settings~i"}, {"name": "ARGS:settings", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings_bulk save_settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-05": {"ajax_action": "exactmetrics_vue_update_settings_bulk", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~view_reports~i"}, {"name": "ARGS:settings", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings_bulk view_reports", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1994-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:ws_plugin__s2member_custom_reg_field_user_pass1", "type": "exists"}], "cve": "CVE-2026-1994", "method": "POST", "mode": "block", "slug": "s2member", "target": "plugin", "versions": "<=260127"}, "RULE-CVE-2026-19949-01": {"ajax_action": "ai1wm_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\\\\\\'){20,}~"}], "cve": "CVE-2026-19949", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19949", "description": "All-in-One WP Migration and Backup <=7.109 unauthenticated SQL injection via archive restore due to unescaped backslash-terminated quoted values in ai1wm_import processing", "mode": "block", "severity": 8.8, "slug": "all-in-one-wp-migration", "tags": ["sql-injection", "unauthenticated", "archive-restore"], "target": "plugin", "versions": "<=7.109"}, "RULE-CVE-2026-19991-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(https?://[^\\\\s<>]{3,200}?)\\\\.\\\\.\\\\1~i"}], "cve": "CVE-2026-19991", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-19991", "description": "UsersWP <=1.2.70 arbitrary file deletion via crafted file/image URL that collapses into path traversal in uwp_get_file_relative_url() before upload_file_remove() deletion", "mode": "block", "severity": 8.1, "slug": "userswp", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.70"}, "RULE-CVE-2026-2001-01": {"ajax_action": "revx_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-2001", "method": "POST", "mode": "block", "severity": 8.8, "slug": "revenue", "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-2020-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(post|admin-ajax)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (post.php/admin-ajax save)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2020-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (REST /wp/v2/posts)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2020-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (REST /wp/v2/pages)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2022-01": {"ajax_action": "rednao_smart_forms_get_campaigns", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2022", "method": "POST", "mode": "block", "severity": 4.3, "slug": "smart-forms", "target": "plugin", "versions": "<2.7.0"}, "RULE-CVE-2026-2023-01": {"ajax_action": "wppic_save_custom_plugin", "conditions": [{"name": "ARGS:wppicFormData[slug]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2023", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2023", "description": "WP Plugin Info Card <=6.2.0 Cross-Site Request Forgery via disabled nonce in wppic_save_custom_plugin AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-plugin-info-card", "tags": ["csrf", "missing-nonce"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-2024-01": {"ajax_action": "myajax-submit", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-2024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2024", "description": "PhotoStack Gallery <=0.4.1 unauthenticated SQL injection via postid parameter in myajax-submit AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "photostack-gallery", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2026-2025-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailmint/v1/contacts(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2025", "description": "Mail Mint <1.19.5 unauthenticated access to contacts REST API endpoint exposing user email addresses", "method": "GET", "mode": "block", "severity": 7.5, "slug": "mail-mint", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.19.5"}, "RULE-CVE-2026-2027-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:amp_enhancer_custom_css_settings[amp_custom_css]", "type": "regex", "value": "~<\\\\s*(?:script|/style)|\\\\bexpression\\\\s*\\\\(|\\\\burl\\\\s*\\\\(\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|-moz-binding\\\\s*:\\\\s*url|\\\\bbehavior\\\\s*:\\\\s*url~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2027", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2027", "description": "AMP Enhancer <=1.0.49 authenticated stored XSS via AMP Custom CSS setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "amp-enhancer", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.49"}, "RULE-CVE-2026-2029-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[labb_pricing_item\\\\b[^\\\\]]*(?:&lt;|&#0*60;?|&#x0*3[cC];?)(?:script|img|svg|iframe|details|object|embed|link|meta|body|input|select|textarea|button|form|marquee|video|audio|source|math|style)[ \\\\t>/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2029", "description": "Livemesh Addons for Beaver Builder <=3.9.2 Stored XSS via labb_pricing_item shortcode title/value attributes (htmlspecialchars_decode after wp_kses_post)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addons-for-beaver-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2026-2052-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS:expression", "type": "regex", "value": "~(?:array_map\\\\s*\\\\(\\\\s*[\'\\"]|array_reduce\\\\s*\\\\(\\\\s*[\'\\"]|create_function\\\\s*\\\\(|preg_replace\\\\s*\\\\(\\\\s*[\'\\"][^\'\\"]*\\\\/e[\'\\"]|(?:call_user_func|call_user_func_array)\\\\s*\\\\()~i"}], "cve": "CVE-2026-2052", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2052", "description": "Widget Options <=4.2.2 authenticated RCE via Display Logic expression bypass using eval-triggering PHP functions", "mode": "block", "severity": 8.8, "slug": "widget-options", "tags": ["remote-code-execution", "code-injection", "authenticated", "bypass"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2026-2144-01": {"action": "init", "conditions": [{"name": "ARGS:uid", "type": "regex", "value": "~^[+]?0*(?:[1-5])$~"}, {"name": "ARGS:token", "type": "regex", "value": "~^[a-f0-9]{20,}$~"}], "cve": "CVE-2026-2144", "method": "GET", "mode": "block", "severity": 8.1, "slug": "magic-login-mail", "target": "plugin", "versions": "<2.07"}, "RULE-CVE-2026-22193-01": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions email parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-02": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:activation_key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions activation_key parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-03": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:subscription_date", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions subscription_date parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-04": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:imported_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions imported_from parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22201-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "REQUEST_HEADERS:Client-IP", "type": "regex", "value": "~^\\\\s*(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\s*$~"}], "cve": "CVE-2026-22201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22201", "description": "wpDiscuz <=7.6.54 IP spoofing via Client-IP header allows bypass of IP-based rate limiting and ban enforcement", "mode": "block", "severity": 5.3, "slug": "wpdiscuz", "tags": ["ip-spoofing", "rate-limit-bypass", "unauthenticated"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-22202-01": {"ajax_action": "wpdiscuzDeleteDataWithEmail", "conditions": [{"name": "ARGS:commentemail", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22202", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22202", "description": "wpDiscuz <=7.6.54 unauthenticated/low-privilege destructive comment deletion via wpdiscuzDeleteDataWithEmail AJAX action (CSRF)", "mode": "block", "severity": 6.5, "slug": "wpdiscuz", "tags": ["cross-site-request-forgery", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-22209-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpdiscuz_form"}, {"name": "ARGS", "type": "regex", "value": "~</\\\\s*style\\\\s*>\\\\s*(?:<\\\\s*(?:script[\\\\s/>]|svg\\\\b|img\\\\b|iframe\\\\b|body\\\\b|input\\\\b)|[^<]*on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2026-22209", "description": "wpDiscuz <7.6.47 admin-authenticated stored XSS via unescaped customCss in wpdiscuz_form CPT rendered inside style tag", "mode": "block", "severity": 5.5, "slug": "wpdiscuz", "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22216-01": {"ajax_action": "wpdAddSubscription", "conditions": [{"name": "ARGS:subscribe_email", "type": "regex", "value": "~[%*?]~"}], "cve": "CVE-2026-22216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22216", "description": "wpDiscuz <=7.6.54 unauthenticated subscription flood via LIKE wildcard email enumeration", "mode": "block", "severity": 5.3, "slug": "wpdiscuz", "tags": ["missing-rate-limiting", "unauthenticated", "email-enumeration"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-2230-01": {"ajax_action": "AJAX_SAVE_USER_META_DATA", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2230", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2230", "description": "Booking Calendar <=10.14.14 authenticated IDOR allows subscriber+ to modify other users booking meta via AJAX_SAVE_USER_META_DATA", "method": "POST", "mode": "block", "severity": 4.3, "slug": "booking", "tags": ["idor", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=10.14.14"}, "RULE-CVE-2026-2231-01": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:first_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via first_name in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-02": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:last_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via last_name in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-03": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:phone", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via phone in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-04": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via message in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-05": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:address", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via address in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-06": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:location[user_location_input]", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via location[user_location_input] in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-07": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_source", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_source in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-08": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_medium", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_medium in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-09": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_campaign", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_campaign in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-10": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_term", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_term in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-11": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_content in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2232-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?i:(?:\'\\\\s+(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s+UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s+(?:\\\\d|NULL\\\\b|@@|CHAR\\\\s*\\\\(|0x[0-9a-f]|version\\\\s*\\\\(|concat\\\\s*\\\\()|\'\\\\s*[^\\\\n]{0,40}\\\\bSLEEP\\\\s*\\\\(|\'\\\\s*[^\\\\n]{0,40}\\\\bBENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\'\\\\s*;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|WAITFOR)\\\\b))~"}], "cve": "CVE-2026-2232", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.2"}, "RULE-CVE-2026-2232-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-ajax=wcpt_ajax(/|&|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?i:(?:\'\\\\s+(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s+UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s+(?:\\\\d|NULL\\\\b|@@|CHAR\\\\s*\\\\(|0x[0-9a-f]|version\\\\s*\\\\(|concat\\\\s*\\\\()|\'\\\\s*[^\\\\n]{0,40}\\\\bSLEEP\\\\s*\\\\(|\'\\\\s*[^\\\\n]{0,40}\\\\bBENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\'\\\\s*;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|WAITFOR)\\\\b))~"}], "cve": "CVE-2026-2232", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.2"}, "RULE-CVE-2026-22344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22344", "description": "fivestar theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fivestar", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22344-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22344", "description": "fivestar theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fivestar", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22345-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "image_gallery"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2026-22345", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22345", "description": "Image Gallery <= 1.6.0 authenticated (Contributor+) PHP Object Injection via save_post deserialization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "new-image-gallery", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2026-22346-01": {"ajax_action": "slide_responsive", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;]|[{])O:[0-9]+:\\"~"}], "cve": "CVE-2026-22346", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22346", "description": "Slider Responsive Slideshow <=1.5.4 PHP object injection via slide_responsive AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "slider-responsive-slideshow", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2026-22347-01": {"ajax_action": "wa_chpcs_action", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~[^a-zA-Z0-9_-]~"}], "cve": "CVE-2026-22347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22347", "description": "Carousel Horizontal Posts Content Slider <=3.3.2 reflected XSS via unsanitized post_type parameter in wa_chpcs_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "carousel-horizontal-posts-content-slider", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-22352-01": {"ajax_action": "change_sms_text", "conditions": [{"name": "ARGS:order_status", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-z]+[^>]*\\\\bon[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22352", "description": "Persian WooCommerce SMS <=7.1.1 reflected XSS via order_status parameter in change_sms_text AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "persian-woocommerce-sms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-22353-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "teachpress/authors.php"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ reflected XSS via search parameter on authors admin page", "method": "GET", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22353-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "teachpress/addpublications.php"}, {"name": "ARGS:tags", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ stored XSS via tags parameter on add publication admin page", "method": "POST", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22353-03": {"ajax_action": "tp_document_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tp_document_upload"}, {"name": "ARGS:/^(async-upload|name)$/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[^>]+onload\\\\s*=|<img[^>]+onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ reflected XSS via async-upload parameter in tp_document_upload AJAX handler", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22357-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via orderby parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via order parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:post_mime_type", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via post_mime_type parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:detached", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via detached parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via type parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:category", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via category parameter in admin error table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via post_id parameter in admin error/click tables", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:codes", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via codes parameter in admin error/report tables", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:link_min_count", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via link_min_count parameter in report search", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:link_max_count", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via link_max_count parameter in report search", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-11": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper_settings"}, {"name": "ARGS:tab", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via tab parameter in settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-12": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper_settings"}, {"name": "ARGS:setting_highlight", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via setting_highlight parameter in settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-13": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:keywords", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via keywords parameter in click details page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22361", "description": "a-mart theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "a-mart", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22361", "description": "a-mart theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "a-mart", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22362", "description": "photolia theme <= 1.0.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "photolia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22362", "description": "photolia theme <= 1.0.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "photolia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22363", "description": "rhodos theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rhodos", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2026-22363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22363", "description": "rhodos theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rhodos", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2026-22364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22364", "description": "seventrees theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "seventrees", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22364", "description": "seventrees theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "seventrees", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22365", "description": "soleng theme <= 1.0.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleng", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.5"}, "RULE-CVE-2026-22365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22365", "description": "soleng theme <= 1.0.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleng", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.5"}, "RULE-CVE-2026-22366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22366", "description": "jude theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jude", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22366", "description": "jude theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jude", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22367", "description": "coworking theme <= 1.6.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "coworking", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2026-22367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22367", "description": "coworking theme <= 1.6.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "coworking", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2026-22368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22368", "description": "redy theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "redy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22368", "description": "redy theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "redy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22369", "description": "ironfit theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ironfit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22369", "description": "ironfit theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ironfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22370", "description": "marveland theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "marveland", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22370", "description": "marveland theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "marveland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22371", "description": "gustavo theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gustavo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22371", "description": "gustavo theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gustavo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22372-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22372", "description": "isida theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "isida", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-22372-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22372", "description": "isida theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "isida", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-22373-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22373", "description": "fooddy theme <= 1.3.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fooddy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.10"}, "RULE-CVE-2026-22373-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22373", "description": "fooddy theme <= 1.3.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fooddy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.10"}, "RULE-CVE-2026-22374-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22374", "description": "zioalberto theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "zioalberto", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22374-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22374", "description": "zioalberto theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "zioalberto", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22375-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22375", "description": "impacto-patronus theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "impacto-patronus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22375-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22375", "description": "impacto-patronus theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "impacto-patronus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22376-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22376", "description": "parkivia theme <= 1.1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "parkivia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22376-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22376", "description": "parkivia theme <= 1.1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "parkivia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22377-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22377", "description": "saveo theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "saveo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22377-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22377", "description": "saveo theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "saveo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22378-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22378", "description": "blabber theme <= 1.7.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "blabber", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2026-22378-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22378", "description": "blabber theme <= 1.7.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "blabber", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2026-22379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22379", "description": "netmix theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "netmix", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-22379-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22379", "description": "netmix theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "netmix", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-22380-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22380", "description": "unlimhost theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unlimhost", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22380-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22380", "description": "unlimhost theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unlimhost", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22381-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22381", "description": "pawfriends theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pawfriends", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22381-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22381", "description": "pawfriends theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pawfriends", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22387", "description": "aviana theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "aviana", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22387", "description": "aviana theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "aviana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22389-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22389", "description": "cocco theme <= 1.5.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cocco", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5.1"}, "RULE-CVE-2026-22389-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22389", "description": "cocco theme <= 1.5.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cocco", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.1"}, "RULE-CVE-2026-22390-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "ba_cheetah_disable"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22390", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22390", "description": "Builderall Builder for WordPress <=3.0.1 missing authorization on ba_cheetah_disable AJAX handler", "mode": "block", "severity": 9.9, "slug": "builderall-cheetah-for-wp", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-22390-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "ba_cheetah_duplicate_wpml_layout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22390", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22390", "description": "Builderall Builder for WordPress <=3.0.1 missing authorization on ba_cheetah_duplicate_wpml_layout AJAX handler", "mode": "block", "severity": 9.9, "slug": "builderall-cheetah-for-wp", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-22392-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22392", "description": "cortex theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cortex", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22392-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22392", "description": "cortex theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cortex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22394-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22394", "description": "evently theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "evently", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22394-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22394", "description": "evently theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "evently", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22395-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22395", "description": "fiorello theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fiorello", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22395-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22395", "description": "fiorello theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fiorello", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22397-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22397", "description": "fleur theme <= 2.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fleur", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.0"}, "RULE-CVE-2026-22397-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22397", "description": "fleur theme <= 2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fleur", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.0"}, "RULE-CVE-2026-22399-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22399", "description": "holmes theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "holmes", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22399-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22399", "description": "holmes theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "holmes", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22403-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22403", "description": "innovio theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "innovio", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22403-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22403", "description": "innovio theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "innovio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22405-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22405", "description": "overton theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "overton", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22405-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22405", "description": "overton theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "overton", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22408-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22408", "description": "justicia theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "justicia", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22408-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22408", "description": "justicia theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "justicia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22410-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22410", "description": "dolcino theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dolcino", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22410-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22410", "description": "dolcino theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dolcino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22412-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22412", "description": "eona theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "eona", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22412-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22412", "description": "eona theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "eona", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22413-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22413", "description": "malgre theme <= 1.0.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "malgre", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22413-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22413", "description": "malgre theme <= 1.0.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "malgre", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22414-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22414", "description": "marra theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "marra", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22414-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22414", "description": "marra theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "marra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22415-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22415", "description": "the-mounty theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "the-mounty", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22415-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22415", "description": "the-mounty theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "the-mounty", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22416", "description": "fixteam theme <= 1.5.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fixteam", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2026-22416-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22416", "description": "fixteam theme <= 1.5.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fixteam", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2026-22418-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22418", "description": "great-lotus theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "great-lotus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-22418-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22418", "description": "great-lotus theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "great-lotus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-22419-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22419", "description": "honor theme <= 2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "honor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3"}, "RULE-CVE-2026-22419-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22419", "description": "honor theme <= 2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "honor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3"}, "RULE-CVE-2026-22420-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22420", "description": "horizon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "horizon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22420-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22420", "description": "horizon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "horizon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22421-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22421", "description": "quantum theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "quantum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22421-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22421", "description": "quantum theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "quantum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22424-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22424", "description": "shaha theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shaha", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22424-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22424", "description": "shaha theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shaha", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22427-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22427", "description": "gotravel theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gotravel", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22427-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22427", "description": "gotravel theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gotravel", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22428-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22428", "description": "tooth-fairy theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tooth-fairy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2026-22428-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22428", "description": "tooth-fairy theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tooth-fairy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2026-22429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22429", "description": "verdure theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "verdure", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22429", "description": "verdure theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "verdure", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22431", "description": "wabi-sabi theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wabi-sabi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22431", "description": "wabi-sabi theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wabi-sabi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22432", "description": "woopy theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "woopy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22432", "description": "woopy theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "woopy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22433", "description": "cloudme theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cloudme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22433", "description": "cloudme theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cloudme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22434", "description": "crown-art theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "crown-art", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2026-22434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22434", "description": "crown-art theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "crown-art", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2026-22435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22435", "description": "electroserv theme <= 1.3.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "electroserv", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22435", "description": "electroserv theme <= 1.3.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "electroserv", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22437-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22437", "description": "playa theme <= 1.3.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "playa", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.9"}, "RULE-CVE-2026-22437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22437", "description": "playa theme <= 1.3.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "playa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.9"}, "RULE-CVE-2026-22439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22439", "description": "green-planet theme <= 1.1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "green-planet", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.14"}, "RULE-CVE-2026-22439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22439", "description": "green-planet theme <= 1.1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "green-planet", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.14"}, "RULE-CVE-2026-22440-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/(?:index\\\\.php)?(?:\\\\?|$)|/(?:archive|blog)(?:/|\\\\?|$))~i"}, {"name": "ARGS:/^(?:s|q|redirect)$/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouse(?:over|down|up)|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22440", "mode": "block", "severity": 7.1, "target": "core", "versions": ">=1.0.0"}, "RULE-CVE-2026-22446-01": {"ajax_action": "prowess_select_blog_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc/self)|%2[Ee]|%5[Cc])~i"}], "cve": "CVE-2026-22446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22446", "description": "Prowess <=1.8.1 unauthenticated local file inclusion via blogType parameter", "mode": "block", "severity": 8.1, "slug": "prowess", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2026-22446-02": {"ajax_action": "prowess_select_blog_shortcode_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc/self)|%2[Ee]|%5[Cc])~i"}], "cve": "CVE-2026-22446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22446", "description": "Prowess <=1.8.1 unauthenticated local file inclusion via blogType parameter (shortcode endpoint)", "mode": "block", "severity": 8.1, "slug": "prowess", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2026-22449-01": {"ajax_action": "donpeppe_select_blog_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:[.][.][/.]{2}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-22449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22449", "description": "Don Peppe Theme <=1.3 local file inclusion via blogType parameter in donpeppe_select_blog_load_more", "mode": "block", "severity": 8.1, "slug": "donpeppe", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22449-02": {"ajax_action": "donpeppe_select_blog_shortcode_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:[.][.][/.]{2}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-22449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22449", "description": "Don Peppe Theme <=1.3 local file inclusion via blogType parameter in shortcode handler", "mode": "block", "severity": 8.1, "slug": "donpeppe", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22457-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22457", "description": "wanderland theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderland", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22457-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22457", "description": "wanderland theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22460-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env)|/etc/passwd~i"}], "cve": "CVE-2026-22460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22460", "description": "FormGent <=1.5.4 unauthenticated arbitrary file deletion via path traversal in REST API", "mode": "block", "severity": 8.6, "slug": "formgent", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2026-22472-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "set_setting_Emsfb"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22472", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22472", "description": "Easy Form Builder <=3.9.6 missing authorization on set_setting_Emsfb AJAX action allows subscriber+ settings manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-form-builder", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.6"}, "RULE-CVE-2026-22472-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "add_addons_Emsfb"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22472", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22472", "description": "Easy Form Builder <=3.9.6 missing authorization on add_addons_Emsfb AJAX action allows subscriber+ arbitrary addon installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-form-builder", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-install"], "target": "plugin", "versions": "<=3.9.6"}, "RULE-CVE-2026-22477-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22477", "description": "felizia theme <= 1.3.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "felizia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.4"}, "RULE-CVE-2026-22477-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22477", "description": "felizia theme <= 1.3.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "felizia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.4"}, "RULE-CVE-2026-22480-01": {"ajax_action": "pf_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22480", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22480", "description": "Product Feed for WooCommerce <=2.3.3 PHP object injection via form_data in pf_export_ajax_basic", "mode": "block", "severity": 7.2, "slug": "webtoffee-product-feed", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-22480-02": {"ajax_action": "pf_schedule_ajax", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22480", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22480", "description": "Product Feed for WooCommerce <=2.3.3 PHP object injection via form_data in pf_schedule_ajax", "mode": "block", "severity": 7.2, "slug": "webtoffee-product-feed", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-22481-01": {"ajax_action": "save_courier_settings", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on save_courier_settings AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-02": {"ajax_action": "refresh_courier_data_edit", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on refresh_courier_data_edit AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-03": {"ajax_action": "refresh_courier_data_list", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on refresh_courier_data_list AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-04": {"ajax_action": "fetch_order_ratios", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on fetch_order_ratios AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22482-01": {"ajax_action": "wb_scrapy_image", "conditions": [{"name": "ARGS:op", "type": "regex", "value": "~^(?:scrapy|down)$~"}, {"name": "ARGS:image", "type": "regex", "value": "~(?:^https?://(?:localhost(?=[:/]|$)|127\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|0\\\\.0\\\\.0\\\\.0(?=[:/]|$)|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|\\\\[::1\\\\](?=[:/]|$)|0x[0-9a-f]{8}(?=[:/]|$))|^file://)~i"}], "cve": "CVE-2026-22482", "method": "POST", "mode": "block", "severity": 9.1, "slug": "imgspider", "target": "plugin", "versions": "<2.3.13"}, "RULE-CVE-2026-22495-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22495", "description": "greenville theme <= 1.3.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greenville", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22495-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22495", "description": "greenville theme <= 1.3.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greenville", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22496-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22496", "description": "hypnotherapy theme <= 1.2.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hypnotherapy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.10"}, "RULE-CVE-2026-22496-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22496", "description": "hypnotherapy theme <= 1.2.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hypnotherapy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.10"}, "RULE-CVE-2026-22502-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22502", "description": "mr-cobbler theme <= 1.1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mr-cobbler", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22502-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22502", "description": "mr-cobbler theme <= 1.1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mr-cobbler", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22507-01": {"ajax_action": "beelove_options_import", "conditions": [{"name": "ARGS:/option_value|import_data/", "type": "regex", "value": "~^(?:[OC]:[0-9]+:\\"|a:[0-9]+:\\\\{)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22507", "description": "BeeLove <=1.2.6 unauthenticated PHP object injection via beelove_options_import AJAX action", "mode": "block", "severity": 9.8, "slug": "beelove", "tags": ["php-object-injection", "deserialization", "unauthenticated", "cwe-502"], "target": "theme", "versions": "<=1.2.6"}, "RULE-CVE-2026-22507-02": {"ajax_action": "beelove_options_save", "conditions": [{"name": "ARGS:option_value", "type": "regex", "value": "~^(?:[OC]:[0-9]+:\\"|a:[0-9]+:\\\\{)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22507", "description": "BeeLove <=1.2.6 unauthenticated PHP object injection via beelove_options_save AJAX action", "mode": "block", "severity": 9.8, "slug": "beelove", "tags": ["php-object-injection", "deserialization", "unauthenticated", "cwe-502"], "target": "theme", "versions": "<=1.2.6"}, "RULE-CVE-2026-22508-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22508", "description": "dentalux theme <= 3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dentalux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2026-22508-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22508", "description": "dentalux theme <= 3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dentalux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2026-22513-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22513", "description": "triompher theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "triompher", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2026-22513-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22513", "description": "triompher theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "triompher", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2026-22514-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22514", "description": "unica theme <= 1.4.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.1"}, "RULE-CVE-2026-22514-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22514", "description": "unica theme <= 1.4.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.1"}, "RULE-CVE-2026-22515-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22515", "description": "vegadays theme <= 1.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "vegadays", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2026-22515-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22515", "description": "vegadays theme <= 1.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "vegadays", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2026-22516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22516", "description": "wizors-investments theme <= 2.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wizors-investments", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.12"}, "RULE-CVE-2026-22516-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22516", "description": "wizors-investments theme <= 2.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wizors-investments", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.12"}, "RULE-CVE-2026-22522-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/block-slider/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22522", "description": "Block Slider <=2.2.3 broken access control on REST API endpoints allows subscriber+ unauthorized data access", "mode": "block", "severity": 6.5, "slug": "block-slider", "tags": ["missing-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.2.3"}, "RULE-CVE-2026-2268-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\\\{post_meta:[^}]+\\\\}~i"}], "cve": "CVE-2026-2268", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.0"}, "RULE-CVE-2026-2268-02": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\\\{user_meta:[^}]+\\\\}~i"}], "cve": "CVE-2026-2268", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.0"}, "RULE-CVE-2026-2279-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "list_links"}, {"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|CONCAT\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|;\\\\s*(?:SELECT|DROP|ALTER|CREATE|INSERT|UPDATE|DELETE)|--\\\\s|/\\\\*|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-2279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2279", "description": "myLinksDump <=1.6 authenticated (Administrator+) SQL Injection via sort_by parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 7.2, "slug": "mylinksdump", "tags": ["sql-injection", "order-by-injection", "authenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-2279-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "list_links"}, {"name": "ARGS:sort_order", "type": "regex", "value": "~^(?!(?:ASC|DESC)$).+~i"}], "cve": "CVE-2026-2279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2279", "description": "myLinksDump <=1.6 authenticated (Administrator+) SQL Injection via sort_order parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 7.2, "slug": "mylinksdump", "tags": ["sql-injection", "order-by-injection", "authenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-22850-01": {"action": "init", "conditions": [{"name": "ARGS:pa", "type": "regex", "value": "~[)\'][ ]*[,;][ ]*(?:[(][ ]*[\'\\"]|DROP |DELETE |INSERT |UPDATE |SELECT |ALTER |TRUNCATE |CREATE |--)~i"}], "cve": "CVE-2026-22850", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22850", "description": "Koko Analytics <2.1.3 stored SQL injection via pa tracking parameter", "mode": "block", "severity": 8.3, "slug": "koko-analytics", "tags": ["sql-injection", "stored-sqli", "tracking"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-22850-02": {"action": "init", "conditions": [{"name": "ARGS:r", "type": "regex", "value": "~[)\'][ ]*[,;][ ]*(?:[(][ ]*[\'\\"]|DROP |DELETE |INSERT |UPDATE |SELECT |ALTER |TRUNCATE |CREATE |--)~i"}], "cve": "CVE-2026-22850", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22850", "description": "Koko Analytics <2.1.3 stored SQL injection via r referrer parameter", "mode": "block", "severity": 8.3, "slug": "koko-analytics", "tags": ["sql-injection", "stored-sqli", "tracking"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-2295-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~\\"post_status\\"[ ]*:~i"}], "cve": "CVE-2026-2295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2295", "description": "WPZOOM Addons for Elementor <=1.3.2 unauthenticated information disclosure via post_status injection in wpz_posts_grid_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpzoom-elementor-addons", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2026-2296-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpa/~"}, {"name": "ARGS", "type": "regex", "value": "~[();`$]|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bpopen\\\\b|\\\\bproc_open\\\\b|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bphpinfo\\\\b|\\\\bbase64_decode\\\\b|\\\\bfile_get_contents\\\\b|\\\\bfile_put_contents\\\\b|\\\\bchr\\\\s*\\\\(|\\\\bpack\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-2296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2296", "description": "Product Addons for Woocommerce <=3.1.0 authenticated (Shop Manager+) PHP code injection via conditional logic operator field in REST API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "woo-custom-product-addons", "tags": ["code-injection", "rce", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-2305-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aFhfc_head_code", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2305", "description": "AddFunc Head & Footer Code <=2.3 stored XSS via aFhfc_head_code", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addfunc-head-footer-code", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2026-2305-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aFhfc_body_code", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2305", "description": "AddFunc Head & Footer Code <=2.3 stored XSS via aFhfc_body_code", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addfunc-head-footer-code", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2026-2305-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aFhfc_footer_code", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2305", "description": "AddFunc Head & Footer Code <=2.3 stored XSS via aFhfc_footer_code", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addfunc-head-footer-code", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2026-2351-01": {"ajax_action": "get_text_from_url_tm", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2351", "description": "Task Manager <=3.0.2 arbitrary file read via get_text_from_url_tm AJAX handler", "mode": "block", "severity": 6.5, "slug": "task-manager", "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-2352-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:ao_post_preload", "type": "regex", "value": "~(?:on(?:load|error|mouseover|focus|click|keydown|mouseenter)[ ]*=|<script[ />]|javascript[ ]*:|\\"[ ]*(?:autofocus|style|tabindex|accesskey)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2026-2352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2352", "description": "Autoptimize <=3.1.14 authenticated stored XSS via ao_post_preload meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "autoptimize", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.1.14"}, "RULE-CVE-2026-23549-01": {"ajax_action": "mep_re_ajax_load_ticket_type_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_ticket_type_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-02": {"ajax_action": "mep_re_ajax_load_extra_service_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_extra_service_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-03": {"ajax_action": "mep_re_ajax_load_ticket_time_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_ticket_time_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-04": {"ajax_action": "mep_event_list_date_schedule", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_event_list_date_schedule", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23550-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/modular-connector/login/.*~i"}], "config": {}, "cve": "CVE-2026-23550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550", "description": "Modular Connector <=2.5.1 unauthenticated privilege escalation in the Modular DS/Modular Connector plugin caused by incorrect privilege assignment and an overly permissive custom routing layer that allows crafted unauthenticated requests to reach login-related endpoints and obtain elevated privileges, as described by NVD, Patchstack, and the vendor advisory.", "mode": "block", "severity": 10.0, "slug": "modular-connector", "tags": ["priv-esc", "auth-bypass", "modular-connector", "routing"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-23550-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(api/modular-connector|api-modular-connector)/(login|lb|oauth)/[^/?]+~i"}], "config": {}, "cve": "CVE-2026-23550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550", "description": "Heuristic coverage for Modular Connector <=2.5.1 privilege escalation where unauthenticated attackers can reach internal login-related routes handled by the plugin\\u2019s custom router (for example, variants of an /api-modular-connector/login path) because routing middleware is bypassed, enabling admin-login behavior consistent with external analyses of this CVE.", "mode": "block", "severity": 10.0, "slug": "modular-connector", "tags": ["priv-esc", "auth-bypass", "modular-connector", "routing"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-2356-01": {"ajax_action": "user_registration_membership_register_member", "conditions": [{"name": "ARGS:members_data", "type": "regex", "value": "~\\"payment_method\\"\\\\s*:\\\\s*\\"\\"~"}], "cve": "CVE-2026-2356", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2356", "description": "User Registration & Membership <=5.1.2 unauthenticated IDOR user deletion via register_member AJAX handler (empty payment_method path)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "improper-access-control", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-2358-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wp_ulike_likers_box[^]]*template[ ]*=[ ]*[\\"\'][^\\"\']*(?:&#(?:0*60|[xX]0*3[cC]);?|&lt;)[ ]*(?:script|img|svg|iframe|details|object|embed|body|marquee|video|audio|input|select|textarea|form|button|a[ ])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-2358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2358", "description": "WP ULike <=5.0.1 Stored XSS via [wp_ulike_likers_box] shortcode template attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ulike", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2358-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]wp_ulike_likers_box[^]]*template[ ]*=[ ]*[\\"\'][^\\"\']*(?:&#(?:0*60|[xX]0*3[cC]);?|&lt;)[ ]*(?:script|img|svg|iframe|details|object|embed|body|marquee|video|audio|input|select|textarea|form|button|a[ ])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-2358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2358", "description": "WP ULike <=5.0.1 Stored XSS via [wp_ulike_likers_box] shortcode template attribute in REST API post/page save", "mode": "block", "severity": 6.4, "slug": "wp-ulike", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2362-01": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[alt]", "type": "regex", "value": "~<[a-zA-Z][^>]*on[a-zA-Z]+=|<(script|svg|iframe|embed|object|math|xmp|noscript)|javascript\\\\s*:~i"}], "cve": "CVE-2026-2362", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2362", "description": "WP Accessibility <=2.3.1 Stored DOM-Based XSS via image alt text in save-attachment AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-accessibility", "tags": ["xss", "stored-dom-xss", "media-library"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2365-01": {"ajax_action": "fluentform_step_form_save_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2026-2365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2365", "description": "Fluent Forms <=6.1.17 unauthenticated stored XSS via fluentform_step_form_save_data AJAX draft endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "fluentform", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.1.17"}, "RULE-CVE-2026-2367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "[ays_block"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2367", "description": "Secure Copy Content Protection <= 5.0.1 Stored XSS via ays_block shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "secure-copy-content-protection", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2367-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[ays_block"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2367", "description": "Secure Copy Content Protection <= 5.0.1 Stored XSS via ays_block shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "secure-copy-content-protection", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-23694-01": {"ajax_action": "ahsc_reset_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23694", "description": "Aruba HiSpeed Cache <3.0.5 CSRF on ahsc_reset_options allows unauthenticated settings reset", "mode": "block", "severity": 4.3, "slug": "aruba-hispeed-cache", "tags": ["csrf", "missing-nonce", "unauthenticated"], "target": "plugin", "versions": "<3.0.5"}, "RULE-CVE-2026-23694-02": {"ajax_action": "ahsc_debug_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23694", "description": "Aruba HiSpeed Cache <3.0.5 CSRF on ahsc_debug_status allows unauthenticated WP_DEBUG toggle", "mode": "block", "severity": 4.3, "slug": "aruba-hispeed-cache", "tags": ["csrf", "missing-nonce", "unauthenticated"], "target": "plugin", "versions": "<3.0.5"}, "RULE-CVE-2026-23694-03": {"ajax_action": "ahsc_enable_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23694", "description": "Aruba HiSpeed Cache <3.0.5 CSRF on ahsc_enable_purge allows unauthenticated cache purge config change", "mode": "block", "severity": 4.3, "slug": "aruba-hispeed-cache", "tags": ["csrf", "missing-nonce", "unauthenticated"], "target": "plugin", "versions": "<3.0.5"}, "RULE-CVE-2026-2371-01": {"ajax_action": "gspb_el_reusable_load", "conditions": [{"type": "missing_capability", "value": "read"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2026-2371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2371", "description": "GreenShift <=12.8.3 unauthenticated IDOR disclosure of private/draft/password-protected reusable blocks via gspb_el_reusable_load AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2373-05": {"ajax_action": "wpr_get_filtered_count_products", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:grid_settings[post_type]", "type": "regex", "value": "~^(?!post$|page$|product$|attachment$|nav_menu_item$|revision$|custom_css$|customize_changeset$|oembed_cache$|user_request$|wp_block$|wp_template$|wp_template_part$|wp_global_styles$|wp_navigation$|elementor_library$)[a-z][a-z0-9_-]{1,31}$~i"}], "cve": "CVE-2026-2373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373", "description": "Royal Elementor Addons <=1.7.1049 unauthenticated CPT count exposure via wpr_get_filtered_count_products", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1049"}, "RULE-CVE-2026-2373-06": {"ajax_action": "wpr_get_media_filtered_count", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:grid_settings[post_type]", "type": "regex", "value": "~^(?!post$|page$|product$|attachment$|nav_menu_item$|revision$|custom_css$|customize_changeset$|oembed_cache$|user_request$|wp_block$|wp_template$|wp_template_part$|wp_global_styles$|wp_navigation$|elementor_library$)[a-z][a-z0-9_-]{1,31}$~i"}], "cve": "CVE-2026-2373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373", "description": "Royal Elementor Addons <=1.7.1049 unauthenticated CPT count exposure via wpr_get_media_filtered_count", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1049"}, "RULE-CVE-2026-2374-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-login\\\\.php|/xmlrpc\\\\.php)/.*(?:<[a-zA-Z]|%3[cC][a-zA-Z]|%253[cC])~i"}], "cve": "CVE-2026-2374", "description": "Login No Captcha reCAPTCHA <=1.8.0 unauthenticated stored XSS via PATH_INFO in $_SERVER[\'PHP_SELF\'] on wp-login.php/xmlrpc.php", "mode": "block", "severity": 7.2, "slug": "login-recaptcha", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-23800-01": {"action": "plugins_loaded", "conditions": [{"name": "ARGS:origin", "type": "equals", "value": "mo"}, {"name": "ARGS:type", "type": "equals", "value": "request"}, {"name": "ARGS:mrid", "type": "regex", "value": "~.+~"}, {"name": "ARGS:sig", "type": "regex", "value": "~.+~"}], "cve": "CVE-2026-23800", "method": "GET", "mode": "block", "severity": 10.0, "slug": "modular-connector", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-23806-01": {"action": "init", "conditions": [{"name": "ARGS:job-search", "type": "regex", "value": "~(?:UNION[\\\\s/*]+(?:ALL[\\\\s/*]+)?SELECT[\\\\s/*]|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|[\'\\")0-9]\\\\s*--\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-23806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23806", "description": "Jobs for WordPress <=2.8 unauthenticated SQL injection via job-search shortcode parameter", "mode": "block", "severity": 7.5, "slug": "job-postings", "tags": ["sql-injection", "unauthenticated", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2026-23807-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wptelegram_widget_view"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-23807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23807", "description": "WP Telegram Widget <=2.2.13 unauthenticated reflected XSS via wptelegram_widget_view admin-post handler", "mode": "block", "severity": 7.1, "slug": "wptelegram-widget", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2026-2386-01": {"ajax_action": "tpae_create_page", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~^(?:page|nxt_builder)$~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-2386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2386", "description": "The Plus Addons for Elementor <=6.4.7 incorrect authorization in tpae_create_page allows Author+ to create restricted post type drafts via post_type parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["incorrect-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=6.4.7"}, "RULE-CVE-2026-23977-01": {"action": "init", "conditions": [{"name": "ARGS:stswpro_save_ticket", "type": "exists"}, {"name": "ARGS:post_title", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23977", "description": "Helpdesk Support Ticket System for WooCommerce <=2.1.2 unauthorized ticket creation via WooCommerce tickets endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "support-ticket-system-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "ticket-creation", "frontend"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2026-2410-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wdanp-edit-redirects"}, {"name": "ARGS:wdan_add_block", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2410", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2410", "description": "Disable Admin Notices <=1.4.1 CSRF on blocked redirect URL addition via wdanp-edit-redirects admin page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "disable-admin-notices", "tags": ["csrf", "cross-site-request-forgery", "settings-change"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2026-2416-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "detectSQLi"}], "cve": "CVE-2026-2416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2416", "description": "Geo Mashup <=1.13.17 unauthenticated SQL injection via sort parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.17"}, "RULE-CVE-2026-2416-02": {"ajax_action": "geo_mashup_suggest_custom_keys", "conditions": [{"name": "ARGS:sort", "type": "detectSQLi"}], "cve": "CVE-2026-2416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2416", "description": "Geo Mashup <=1.13.17 authenticated SQL injection via sort parameter in geo_mashup_suggest_custom_keys AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=1.13.17"}, "RULE-CVE-2026-2420-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "ltm_popup_group"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2420", "description": "LotekMedia Popup Form <=1.0.6 stored XSS via plugin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ltm-popup-form", "tags": ["stored-xss", "authenticated", "settings"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-2429-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_community_events_venues"}, {"name": "ARGS:ce_csv_import", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2429", "description": "Community Events <=1.5.8 authenticated (admin+) SQL injection via ce_venue_name CSV field in venue import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "community-events", "tags": ["sql-injection", "csv-import", "authenticated"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2026-2430-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img[^>]*src=[\\"\'][^\\"\']*[ \\\\t\\\\n\\\\r]src=~i"}], "cve": "CVE-2026-2430", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2430", "description": "Autoptimize <=3.1.14 Stored XSS via crafted img tag in post_content exploiting lazy-load regex", "method": "POST", "mode": "block", "severity": 6.4, "slug": "autoptimize", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.1.14"}, "RULE-CVE-2026-2430-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<img[^>]*src=[\\"\'][^\\"\']*[ \\\\t\\\\n\\\\r]src=~i"}], "cve": "CVE-2026-2430", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2430", "description": "Autoptimize <=3.1.14 Stored XSS via crafted img tag in REST API post content exploiting lazy-load regex", "method": "POST", "mode": "block", "severity": 6.4, "slug": "autoptimize", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.1.14"}, "RULE-CVE-2026-2431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "cm-custom-reports"}, {"name": "ARGS:date_from", "type": "regex", "value": "~(?:<|>|\\"|\'|on[a-zA-Z0-9_]+[ ]*=|script|svg|img)~i"}], "cve": "CVE-2026-2431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2431", "description": "CM Custom Reports <=1.2.7 Reflected XSS via date_from parameter on admin reports page", "mode": "block", "severity": 6.1, "slug": "cm-custom-reports", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-2431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "cm-custom-reports"}, {"name": "ARGS:date_to", "type": "regex", "value": "~(?:<|>|\\"|\'|on[a-zA-Z0-9_]+[ ]*=|script|svg|img)~i"}], "cve": "CVE-2026-2431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2431", "description": "CM Custom Reports <=1.2.7 Reflected XSS via date_to parameter on admin reports page", "mode": "block", "severity": 6.1, "slug": "cm-custom-reports", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-24353-01": {"ajax_action": "user_registration_membership_register_member", "conditions": [{"name": "ARGS:members_data", "type": "regex", "value": "~(?:administrator|editor|manage_options|delete_users|edit_users)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24353", "description": "User Registration <= 4.4.9 privilege escalation via membership registration allowing non-admin role assignment", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["priv-esc", "role-assignment"], "target": "plugin", "versions": "<=4.4.9"}, "RULE-CVE-2026-24357-01": {"ajax_action": "wprm_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_reset_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-02": {"ajax_action": "wprm_export_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_export_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-03": {"ajax_action": "wprm_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_import_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-04": {"ajax_action": "wprm_export_templates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_export_templates AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-05": {"ajax_action": "wprm_import_templates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_import_templates AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-06": {"ajax_action": "wprm_anonymize_ratings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_anonymize_ratings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "data-manipulation"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-07": {"ajax_action": "wprm_analytics_export_csv", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_analytics_export_csv AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-08": {"ajax_action": "wprm_health_check", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_health_check AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24359-01": {"ajax_action": "dokan_handle_withdraw_request", "conditions": [{"name": "ARGS:amount", "type": "exists"}, {"name": "ARGS:withdraw", "type": "exists"}, {"type": "missing_capability", "value": "dokan_manage_withdraw"}], "config": {}, "cve": "CVE-2026-24359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24359", "description": "Dokan Lite <=4.2.4 missing authorization on vendor withdrawal operations allows authenticated vendor to process unauthorized withdrawals", "method": "POST", "mode": "block", "severity": 8.8, "slug": "dokan-lite", "tags": ["missing-authorization", "broken-authentication", "privilege-escalation"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2026-24361-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/reviews(?:[/?&]|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-24361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24361", "description": "LearnPress Course Review <=4.1.9 stored XSS via title on learnpress/v1 review REST submission", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress-course-review", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.1.9"}, "RULE-CVE-2026-24361-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/reviews(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-24361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24361", "description": "LearnPress Course Review <=4.1.9 stored XSS via content on learnpress/v1 review REST submission", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress-course-review", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.1.9"}, "RULE-CVE-2026-24373-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~"}, {"name": "ARGS:form_id", "type": "exists"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|author|contributor)(?:\\\\s|$)~i"}], "cve": "CVE-2026-24373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24373", "description": "RegistrationMagic <=6.0.7.1 unauthenticated privilege escalation via rm_user_role parameter in registration form submission", "method": "POST", "mode": "block", "severity": 8.1, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2026-24374-01": {"ajax_action": "rm_activate_rm_user", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24374", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24374", "description": "RegistrationMagic <= 6.0.6.9 broken authentication on user activation allowing non-admin account takeover", "method": "POST", "mode": "block", "severity": 5.4, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.9"}, "RULE-CVE-2026-24377-01": {"ajax_action": "tpgb_get_template_content", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-24377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24377", "description": "Nexter Blocks <=4.6.3 unauthenticated sensitive data exposure via tpgb_get_template_content AJAX handler", "mode": "block", "severity": 7.5, "slug": "the-plus-addons-for-block-editor", "tags": ["sensitive-data-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-24378-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-24378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24378", "description": "EventPrime <=4.2.8.0 unauthenticated PHP object injection via eventprime_api AJAX handler", "mode": "block", "severity": 9.8, "slug": "eventprime-event-calendar-management", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8.0"}, "RULE-CVE-2026-24382-01": {"ajax_action": "newsx_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-24382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24382", "description": "News Magazine X <=1.2.50 unauthenticated plugin activation via newsx_activate_required_plugins AJAX handler", "mode": "block", "severity": 7.5, "slug": "news-magazine-x", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "theme", "versions": "<=1.2.50"}, "RULE-CVE-2026-24383-01": {"ajax_action": "bsbPosts", "conditions": [{"name": "ARGS:queryAttr", "type": "regex", "value": "~(?i)(</?[a-z][a-z0-9]*[\\\\s>]|<script|<img|onerror\\\\s*=|onload\\\\s*=|javascript:)~"}], "cve": "CVE-2026-24383", "method": "POST", "mode": "block", "severity": 6.5, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2026-24385-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/podlove-web-player/(?:options|configs)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24385", "description": "Podlove Web Player <=5.9.1 PHP Object Injection via unauthenticated REST options/configs endpoints", "method": "POST", "mode": "block", "severity": 7.5, "slug": "podlove-web-player", "tags": ["object-injection", "deserialization", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<=5.9.1"}, "RULE-CVE-2026-24389-01": {"ajax_action": "pb_save_gallery", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:gallery_data", "type": "regex", "value": "~custom_event_[a-z_]*[^}]*?(?:<script[\\\\s/>]|<img[^>]*onerror[\\\\s]*=|<svg[^>]*onload[\\\\s]*=|on(?:error|load|click|mouseover|focus|blur|toggle)[\\\\s]*=|=\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2026-24389", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24389", "description": "Gallery PhotoBlocks <=1.3.2 stored XSS via custom event fields in gallery save for users without unfiltered_html capability", "mode": "block", "severity": 6.5, "slug": "photoblocks-grid-gallery", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2026-2440-01": {"ajax_action": "SurveyJS_SaveResult", "conditions": [{"name": "ARGS:Json", "type": "regex", "value": "~&(amp;)?#(?:x0*(?:3[cC]|3[eE]|2[27fF]|3[bB]|2[28fF]|2[29fF])|0*(?:60|62|34|39|59|40|41));~i"}], "cve": "CVE-2026-2440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2440", "description": "SurveyJS <=2.5.3 stored XSS via HTML-entity-encoded payloads in Json survey result submissions", "method": "POST", "mode": "block", "severity": 7.2, "slug": "surveyjs", "tags": ["xss", "stored-xss", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-2442-01": {"ajax_action": "pagelayer_contact_submit", "conditions": [{"name": "ARGS:/pagelayer_name|pagelayer_email|pagelayer_subject|pagelayer_message/", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2026-2442", "description": "PageLayer <=2.0.7 CRLF injection via contact form submission allows email header injection", "mode": "block", "severity": 5.3, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-2448-01": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in live editor preview", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-2448-02": {"ajax_action": "so_panels_layout_block_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in layout block preview", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-2448-03": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in builder content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-24523-01": {"ajax_action": "WP_FullCalendar", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "attachment"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24523", "description": "WP FullCalendar <=1.6 unauthenticated attachment enumeration via WP_FullCalendar AJAX action with type=attachment", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-fullcalendar", "tags": ["sensitive-data-exposure", "information-disclosure", "ajax", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-24524-01": {"ajax_action": "store_tablesome_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on store_tablesome_data AJAX handler allows low-privilege users to modify table data", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24524-02": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on get_tables_data AJAX handler allows low-privilege users to read all table data", "method": "GET", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24524-03": {"ajax_action": "get_table_columns", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on get_table_columns AJAX handler allows low-privilege users to read table column metadata", "method": "GET", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24525-01": {"action": "admin_init", "conditions": [{"name": "ARGS:clp-varnish-cache", "type": "equals", "value": "purge-entire-cache"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24525", "description": "CLP Varnish Cache <=1.0.2 unauthenticated cache purge via missing authorization on clp-varnish-cache GET parameter", "mode": "block", "severity": 5.3, "slug": "clp-varnish-cache", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-24526-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~a3blocks/product-inquiry-button[^}]*\\"(?:textAlign|width)\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|%3C|>|%3E)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24526-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|edit_post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:a3blocks/product-inquiry-button\\\\b[^>]*\\\\{[^}]*\\"(?:textAlign|width)\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|%3C|>|%3E)[^\\"]*\\"[^}]*\\\\}[^>]*-->~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24529-01": {"ajax_action": "cancel", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on cancel AJAX action allows authenticated users to cancel bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-02": {"ajax_action": "confirm_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on confirm_email AJAX action allows authenticated users to confirm bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-03": {"ajax_action": "pending_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on pending_email AJAX action allows authenticated users to set bookings to pending", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-04": {"ajax_action": "reject_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on reject_email AJAX action allows authenticated users to reject bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24530-01": {"ajax_action": "webpc_remove_all_originals", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated file deletion via webpc_remove_all_originals AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-02": {"ajax_action": "webpc_remove_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated file deletion via webpc_remove_single AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-03": {"ajax_action": "webpc_remove_originals_selected", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated batch file deletion via webpc_remove_originals_selected AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-04": {"ajax_action": "webpc_convert_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated image conversion via webpc_convert_single AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-05": {"ajax_action": "webpc_convert_selected", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated batch image conversion via webpc_convert_selected AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-06": {"ajax_action": "webpc_restore_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated image restore via webpc_restore_single AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-07": {"ajax_action": "webpc_restore_selected", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated batch image restore via webpc_restore_selected AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "file-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24530-08": {"ajax_action": "update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24530", "description": "WebP Conversion <=2.2 unauthenticated settings modification via update AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "webp-conversion", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24532-01": {"ajax_action": "sitelock_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_scan AJAX handler allows subscribers to trigger scans", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24532-02": {"ajax_action": "sitelock_dismiss_notice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_dismiss_notice AJAX handler allows subscribers to dismiss admin notices", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=bab_Dashboard~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24565", "mode": "block", "severity": 6.5, "slug": "b-accordion", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-24572-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nelio-content/v1/posts(/|\\\\?|$)~"}, {"name": "ARGS:searchTerm", "type": "regex", "value": "~(?:\'[ \\\\t]*(?:OR|AND)[ \\\\t]+[0-9]|UNION[ \\\\t]+(?:ALL[ \\\\t]+)?SELECT|\'[ \\\\t]*(?:--|#)|SLEEP[ \\\\t]*\\\\(|BENCHMARK[ \\\\t]*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24572", "description": "Nelio Content <=4.2.0 authenticated (Contributor+) SQL injection via searchTerm in REST posts endpoint", "method": "GET", "mode": "block", "severity": 8.8, "slug": "nelio-content", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-24596-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "relpoststh_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:</style|<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-24596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24596", "description": "Related Posts Thumbnails <=4.3.2 CSRF to stored XSS via unsanitized plugin settings in head_style output", "method": "POST", "mode": "block", "severity": 4.7, "slug": "related-posts-thumbnails", "tags": ["csrf", "stored-xss", "settings-update"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-24616-01": {"ajax_action": "wppopups_settings_provider_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_add AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24616-02": {"ajax_action": "wppopups_settings_provider_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_disconnect AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24623-01": {"action": "init", "conditions": [{"name": "ARGS:forum", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via forum parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-02": {"action": "init", "conditions": [{"name": "ARGS:topic", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via topic parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-03": {"ajax_action": "neoforum_get_new_topic_form", "conditions": [{"name": "ARGS:forumid", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 authenticated reflected XSS via forumid parameter in neoforum_get_new_topic_form AJAX handler", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-01": {"ajax_action": "neoforum_close_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in close_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-02": {"ajax_action": "neoforum_restrict_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in restrict_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-03": {"ajax_action": "neoforum_delete_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in delete_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-04": {"ajax_action": "neoforum_edit_forum_title", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_title AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-05": {"ajax_action": "neoforum_edit_forum_descr", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-06": {"ajax_action": "neoforum_delete_moderators", "conditions": [{"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via type in delete_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-07": {"ajax_action": "neoforum_add_moderators", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in add_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-08": {"ajax_action": "neoforum_topic_restore", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-09": {"ajax_action": "neoforum_topic_eradicate", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-10": {"ajax_action": "neoforum_post_restore", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-11": {"ajax_action": "neoforum_post_eradicate", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-12": {"ajax_action": "neoforum_report_leave_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_leave_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-13": {"ajax_action": "neoforum_report_delete_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_delete_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-14": {"ajax_action": "neoforum_ban_user", "conditions": [{"name": "ARGS:ban", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via ban in ban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-15": {"ajax_action": "neoforum_unban_user", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in unban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-16": {"ajax_action": "neoforum_make_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in make_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-17": {"ajax_action": "neoforum_remove_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in remove_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-18": {"ajax_action": "neoforum_delete_topic", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in delete_topic AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-19": {"ajax_action": "neoforum_theme_descr", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|[\\\\/\\\\\\\\]etc[\\\\/\\\\\\\\]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated local file inclusion via theme in theme_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24637-01": {"ajax_action": "powerpress_media_info", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24637", "description": "Blocks unauthenticated/low-privilege SQL injection via powerpress_media_info AJAX handler (CWE-89, Contributor+ SQLi in PowerPress <= 11.15.10). Requires edit_posts capability, mirroring the vendor patch.", "mode": "block", "severity": 8.5, "slug": "powerpress", "target": "plugin", "versions": "<=11.15.10"}, "RULE-CVE-2026-2471-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"[^\\"]*\\":\\\\d+:\\\\{~"}], "cve": "CVE-2026-2471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2471", "description": "WP Mail Logging <=1.15.0 unauthenticated PHP Object Injection via serialized object payload in form fields logged by wp_mail hook", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-mail-logging", "tags": ["object-injection", "deserialization", "unauthenticated", "stored-payload"], "target": "plugin", "versions": "<=1.15.0"}, "RULE-CVE-2026-2479-01": {"ajax_action": "rl_upload_image", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2479", "description": "Responsive Lightbox & Gallery <=2.7.1 SSRF via strpos()-based hostname bypass in rl_upload_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "responsive-lightbox", "tags": ["ssrf", "hostname-bypass", "authenticated"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-2486-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ma_el_bh_table_btn_text[\\\\\\"\']\\\\s*:\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<[^>]+\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<iframe\\\\b|<embed\\\\b|<object\\\\b)~i"}], "cve": "CVE-2026-2486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2486", "description": "Master Addons for Elementor <=2.1.1 Stored XSS via ma_el_bh_table_btn_text in Elementor AJAX save (event handler vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "master-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-2486-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ma_el_bh_table_btn_text[\\\\\\"\']\\\\s*:\\\\s*[\\\\\\"\'][^\\\\\\"\']*<script\\\\b~i"}], "cve": "CVE-2026-2486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2486", "description": "Master Addons for Elementor <=2.1.1 Stored XSS via ma_el_bh_table_btn_text in Elementor AJAX save (script tag vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "master-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-2489-01": {"ajax_action": "tp2wp_importer_attachments", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|video|audio|math|details|body|form|input|link|style|base|meta|a)[^a-zA-Z0-9](?:[^>]*(?:on[a-zA-Z]+=|(?:href|src|action|formaction|data) *= *[\\"\']? *(?:javascript|data|vbscript) *:))?~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2489", "description": "TP2WP Importer <=1.1 Authenticated (Administrator+) Stored XSS via Watched Domains AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "tp2wp-importer", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-2495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/WPNakama/v1/boards(?:[/?&]|$)~i"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,|CASE\\\\s+WHEN|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2026-2495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2495", "description": "WPNakama <=0.6.5 unauthenticated SQL injection via order parameter on /WPNakama/v1/boards REST endpoint", "mode": "block", "severity": 7.5, "slug": "wpnakama", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.6.5"}, "RULE-CVE-2026-24950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/authorsy/v1/authors(?:/|$|\\\\?)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24950", "description": "Authorsy <=1.0.6 unauthenticated access to REST API author endpoints leaking sensitive user data (IDOR)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "authorsy", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-24952-01": {"ajax_action": "update_episode_embed_code", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|<iframe[\\\\s/>]|<img\\\\b[^>]*\\\\bon[a-z]+\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-24952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24952", "description": "Seriously Simple Podcasting <=3.14.1 authenticated XSS via width parameter in update_episode_embed_code AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "seriously-simple-podcasting", "tags": ["xss", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-24954-01": {"ajax_action": "mpwem_save_faq", "conditions": [{"name": "ARGS:/^mep_faq/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_faq AJAX handler (question/answer fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-02": {"ajax_action": "mpwem_save_timeline", "conditions": [{"name": "ARGS:/^mep_timeline_details/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_timeline AJAX handler (title/desc fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_speaker_list", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_speaker_list)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_event_cc_email_text", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_event_cc_email_text)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:/^mep_ev_more_date/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_ev_more_date)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24956-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpdm-elementor/v1/search-packages(/|\\\\?|&|$)~"}, {"name": "ARGS:term", "type": "regex", "value": "~(?:union(?:/[*][^*]*[*]/|[+[:space:]])+(?:all(?:/[*][^*]*[*]/|[+[:space:]])+)?select|select(?:/[*][^*]*[*]/|[+[:space:]])+.*from|(?:sleep|benchmark)[[:space:]]*[(]|waitfor(?:/[*][^*]*[*]/|[+[:space:]])+delay|load_file[[:space:]]*[(]|into(?:/[*][^*]*[*]/|[+[:space:]])+(?:outfile|dumpfile)|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[0-9]+[[:space:]]*=[[:space:]]*[0-9]+|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]+[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`][^\\"\'`]+[\\"\'`]|[\\"\'`][[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]*[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`])~i"}], "cve": "CVE-2026-24956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24956", "description": "Download Manager Addons for Elementor <=1.3.0 blind SQL injection via term parameter in search-packages REST endpoint", "method": "GET", "mode": "block", "severity": 9.3, "slug": "wpdm-elementor", "tags": ["sql-injection", "blind-sqli", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2026-24957-01": {"ajax_action": "wpmtst_add_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-02": {"ajax_action": "wpmtst_add_field_2", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_2 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-03": {"ajax_action": "wpmtst_add_field_3", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_3 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-04": {"ajax_action": "wpmtst_add_field_4", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_4 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24959-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via id parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-24959-02": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via status parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-24968-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_restore_mysql_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated arbitrary database restore via xagio_restore_mysql_backup AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "site-takeover"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_restore_full_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated arbitrary full backup restore via xagio_restore_full_backup AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "site-takeover"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_restore_file_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated arbitrary file backup restore via xagio_restore_file_backup AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "site-takeover"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-04": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_llms_save"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated LLM settings modification via xagio_llms_save AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_queued_groups_completed"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated project queue manipulation via xagio_queued_groups_completed AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-06": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_queued_keywords_completed"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated keyword queue manipulation via xagio_queued_keywords_completed AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-24968-07": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "xagio_announcements"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24968", "description": "Xagio SEO <=7.1.0.30 unauthenticated information disclosure via xagio_announcements AJAX handler", "mode": "block", "severity": 9.8, "slug": "xagio-seo", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.1.0.30"}, "RULE-CVE-2026-2498-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_admins", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_admins settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_app_id", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_app_id settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_site", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_site settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_type", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_card", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_card settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_gp_type", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_gp_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-24984-01": {"ajax_action": "vlp_get_post_content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24984", "description": "Visual Link Preview <=2.2.9 missing authorization on vlp_get_post_content allows unauthorized post content disclosure", "mode": "block", "severity": 6.5, "slug": "visual-link-preview", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-2499-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpcl_custom_logo_path", "type": "regex", "value": "~(<script|</style|javascript:|on(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-2499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2499", "description": "Custom Logo <=2.2 Authenticated (Administrator+) Stored XSS via wpcl_custom_logo_path setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-logo", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24990-01": {"ajax_action": "wpdocs_create_folder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24990", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2026-24990-02": {"ajax_action": "wpdocs_delete_folder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24990", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2026-25001-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[post_snippets[^\\\\]]*(?:(?:eval|assert|system|exec|include|require)\\\\s*\\\\(|passthru\\\\s*\\\\(|shell_exec\\\\s*\\\\(|popen\\\\s*\\\\(|proc_open\\\\s*\\\\(|pcntl_exec\\\\s*\\\\(|base64_decode\\\\s*\\\\(|file_(?:get_contents|put_contents)\\\\s*\\\\(|unserialize\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-25001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25001", "description": "Post Snippets <=4.0.12 authenticated (Contributor+) Remote Code Execution via shortcode PHP eval of attacker-controlled attributes", "mode": "block", "severity": 8.5, "slug": "post-snippets", "tags": ["remote-code-execution", "code-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.0.12"}, "RULE-CVE-2026-25002-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress-sepay/v1/webhook(?:[/?]|$)~"}, {"name": "REQUEST_HEADERS:Authorization", "type": "regex", "value": "~^.{1,31}$~"}], "cve": "CVE-2026-25002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25002", "description": "LearnPress - Sepay Payment <=4.0.0 broken authentication on webhook REST endpoint via substring API key matching", "method": "POST", "mode": "block", "severity": 7.5, "slug": "learnpress-sepay-payment", "tags": ["broken-authentication", "rest-api", "unauthenticated", "payment-bypass"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-25007-01": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT(?:[\\\\s(]|$)|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\b|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|[\'\\\\\\")]+\\\\s*(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|OR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+))~i"}], "cve": "CVE-2026-25007", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25007", "description": "ElementInvader Addons for Elementor <=1.4.2 SQL injection via forms AJAX handler", "mode": "block", "severity": 8.6, "slug": "elementinvader-addons-for-elementor", "tags": ["sql-injection", "unauthenticated", "forms"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-2502-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "detectXSS"}], "cve": "CVE-2026-2502", "mode": "block", "severity": 6.1, "slug": "xmlrpc-attacks-blocker", "target": "plugin", "versions": "<1.1"}, "RULE-CVE-2026-25022-01": {"ajax_action": "ajax_post", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "static_data"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|SELECT[ ]+.{0,200}FROM[ ]+|(?:AND|OR)[ ]+[0-9]+[ ]*=[ ]*[0-9]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(][ ]*\\\\~[ ]*|(?:AND|OR)[ ]+(?:IF|CASE)[ ]*[(])~i"}], "cve": "CVE-2026-25022", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25022", "description": "KiviCare Clinic Management System <=3.6.16 SQL injection via ajax_post dispatcher (static_data route)", "method": "POST", "mode": "block", "severity": 8.5, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25022-02": {"ajax_action": "ajax_get", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "static_data"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|SELECT[ ]+.{0,200}FROM[ ]+|(?:AND|OR)[ ]+[0-9]+[ ]*=[ ]*[0-9]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(][ ]*\\\\~[ ]*|(?:AND|OR)[ ]+(?:IF|CASE)[ ]*[(])~i"}], "cve": "CVE-2026-25022", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25022", "description": "KiviCare Clinic Management System <=3.6.16 SQL injection via ajax_get dispatcher (static_data route)", "method": "GET", "mode": "block", "severity": 8.5, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25025-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:action", "type": "equals", "value": "vikrestaurants"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/]on)~i"}], "cve": "CVE-2026-25025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25025", "description": "VikRestaurants <=1.5.2 unauthenticated reflected XSS via vikrestaurants AJAX handler", "mode": "block", "severity": 7.1, "slug": "vikrestaurants", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-25026-01": {"ajax_action": "tlp_team_smart_popup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25026", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25026", "description": "Team Plugin <=5.0.11 missing authorization on tlp_team_smart_popup allows unauthenticated/subscriber access to team member popup data", "mode": "block", "severity": 7.5, "slug": "tlp-team", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=5.0.11"}, "RULE-CVE-2026-25026-02": {"ajax_action": "tlp_md_popup_single", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25026", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25026", "description": "Team Plugin <=5.0.11 missing authorization on tlp_md_popup_single allows unauthenticated/subscriber access to team member modal data", "mode": "block", "severity": 7.5, "slug": "tlp-team", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=5.0.11"}, "RULE-CVE-2026-25030-01": {"ajax_action": "ideapark_wishlist_toggle", "conditions": [{"name": "REQUEST_COOKIES:ideapark_wishlist", "type": "regex", "value": "~^(?:[OC]:[0-9]+:\\"|a:[0-9]+:\\\\{)~"}], "cve": "CVE-2026-25030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25030", "description": "Goldish <=3.45 unauthenticated PHP object injection via ideapark_wishlist cookie", "mode": "block", "severity": 9.8, "slug": "goldish", "tags": ["object-injection", "deserialization", "unauthenticated", "cookie-injection"], "target": "theme", "versions": "<=3.45"}, "RULE-CVE-2026-2504-01": {"ajax_action": "dealia_ajax_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_reset AJAX handler allowing Contributor+ plugin configuration reset", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-02": {"ajax_action": "dealia_ajax_login", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_login AJAX handler allowing Contributor+ API credential hijack", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "credential-hijack"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-03": {"ajax_action": "dealia_ajax_manage_account", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_manage_account AJAX handler allowing Contributor+ external account creation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "account-creation"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-04": {"ajax_action": "dealia_save_additional_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_save_additional_settings AJAX handler allowing Contributor+ settings modification", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-05": {"ajax_action": "dealia_ajax_refresh", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_refresh AJAX handler allowing Contributor+ token refresh", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "token-refresh"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-06": {"ajax_action": "dealia_get_forms", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_get_forms AJAX handler allowing Contributor+ information disclosure", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2506-01": {"action": "init", "conditions": [{"name": "ARGS:customer_name", "type": "exists"}, {"name": "ARGS:customer_name", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 unauthenticated stored XSS via customer_name in front-end order form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2506-02": {"action": "admin_init", "conditions": [{"name": "ARGS:cpage", "type": "exists"}, {"name": "ARGS:cpage", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 reflected XSS via cpage parameter on admin Customers page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2509-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?<![a-zA-Z])on(?:pointer(?:over|enter|leave|down|up|move|out|cancel|rawupdate)|animation(?:end|start|iteration|cancel)|transition(?:end|run|start|cancel)|focus(?:in|out)|auxclick|toggle|beforeinput|formdata|reset|select(?:start)?|gotpointercapture|lostpointercapture|webkitanimation(?:end|start|iteration)|webkittransitionend|touch(?:start|end|move|cancel)|wheel|contextmenu|drag(?:start|end|over|enter|leave)|drop|before(?:copy|cut|paste|toggle)|scrollend|securitypolicyviolation)\\\\s*=~i"}], "cve": "CVE-2026-2509", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2509", "description": "Pagelayer <=2.0.8 contributor+ stored XSS via incomplete event handler blocklist in Button widget custom_attributes (pagelayer_save_content)", "mode": "block", "severity": 6.4, "slug": "pagelayer", "tags": ["xss", "stored", "authenticated", "incomplete-sanitization"], "target": "plugin", "versions": "<=2.0.8"}, "RULE-CVE-2026-2509-02": {"ajax_action": "pagelayer_save_templ_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?<![a-zA-Z])on(?:pointer(?:over|enter|leave|down|up|move|out|cancel|rawupdate)|animation(?:end|start|iteration|cancel)|transition(?:end|run|start|cancel)|focus(?:in|out)|auxclick|toggle|beforeinput|formdata|reset|select(?:start)?|gotpointercapture|lostpointercapture|webkitanimation(?:end|start|iteration)|webkittransitionend|touch(?:start|end|move|cancel)|wheel|contextmenu|drag(?:start|end|over|enter|leave)|drop|before(?:copy|cut|paste|toggle)|scrollend|securitypolicyviolation)\\\\s*=~i"}], "cve": "CVE-2026-2509", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2509", "description": "Pagelayer <=2.0.8 contributor+ stored XSS via incomplete event handler blocklist in Button widget custom_attributes (pagelayer_save_templ_content)", "mode": "block", "severity": 6.4, "slug": "pagelayer", "tags": ["xss", "stored", "authenticated", "incomplete-sanitization"], "target": "plugin", "versions": "<=2.0.8"}, "RULE-CVE-2026-2511-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:multiformid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bAND\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-2511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2511", "description": "JS Support Ticket <=3.0.4 unauthenticated SQL injection via multiformid parameter in jsticket_ajax AJAX handler", "mode": "block", "severity": 7.5, "slug": "js-support-ticket", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-2511-02": {"action": "init", "conditions": [{"name": "ARGS:multiformid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bAND\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-2511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2511", "description": "JS Support Ticket <=3.0.4 unauthenticated SQL injection via multiformid parameter in frontend form submission", "mode": "block", "severity": 7.5, "slug": "js-support-ticket", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-2519-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^bookly[a-z0-9_-]*~i"}, {"name": "ARGS:tips", "type": "regex", "value": "~^\\\\s*(?:-|%2[Dd]|\\\\xe2\\\\x88\\\\x92)\\\\s*[0-9]+(?:\\\\.[0-9]+)?(?:[eE]-?[0-9]+)?\\\\s*$~"}], "cve": "CVE-2026-2519", "description": "Bookly <=27.0 unauthenticated price manipulation via negative tips parameter (CWE-472)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.0"}, "RULE-CVE-2026-25309-01": {"ajax_action": "ppma_block_fetch_author_boxes", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25309", "description": "PublishPress Authors <=4.10.1 unauthenticated access to author box editor preview via ppma_block_fetch_author_boxes", "mode": "block", "severity": 7.5, "slug": "publishpress-authors", "tags": ["missing-authorization", "broken-access-control", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.10.1"}, "RULE-CVE-2026-25345-01": {"ajax_action": "pgc_sgb_action_wizard", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25345", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25345", "description": "Simply Gallery Block <=3.3.2 unauthorized access to pgc_sgb_action_wizard AJAX handler", "mode": "block", "severity": 9.9, "slug": "simply-gallery-block", "tags": ["arbitrary-code-execution", "missing-authorization", "rce"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-25346-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "faq-builder-ays"}, {"name": "ARGS:faq", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25346", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25346", "description": "FAQ Builder AYS <=1.8.3 reflected XSS via faq parameter in admin page", "mode": "block", "severity": 7.1, "slug": "faq-builder-ays", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.8.3"}, "RULE-CVE-2026-25361-01": {"ajax_action": "mep_event_list_date_schedule", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~(?:<script[^a-zA-Z]|on(?:error|load|mouseover|click|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<(?:img|svg|iframe|object|embed|video|audio|details|math)[^a-zA-Z])~i"}], "cve": "CVE-2026-25361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25361", "description": "WPEvently <=5.1.4 unauthenticated reflected XSS via event_id in mep_event_list_date_schedule AJAX handler", "mode": "block", "severity": 7.1, "slug": "mage-eventpress", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-25366-01": {"ajax_action": "wbcr_inp_ajax_validate_snippet", "conditions": [{"name": "ARGS:snippet_code", "type": "regex", "value": "~(?:\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|create_function)\\\\s*\\\\(|`[^`]+`|\\\\$_(?:GET|POST|REQUEST|FILES|SERVER|COOKIE)\\\\s*\\\\[|\\\\b(?:base64_decode|str_rot13|gzinflate|gzuncompress)\\\\s*\\\\(\\\\s*[\'\\"]|\\\\b(?:file_put_contents|fwrite|fputs|move_uploaded_file)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25366", "description": "Woody ad snippets (insert-php) <=2.7.1 contributor+ RCE via arbitrary PHP in snippet_code on wbcr_inp_ajax_validate_snippet AJAX handler", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["code-injection", "remote-code-execution", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-25366-02": {"ajax_action": "winp_snippet_create", "conditions": [{"name": "ARGS:snippet_type", "type": "regex", "value": "~^php$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25366", "description": "Woody ad snippets (insert-php) <=2.7.1 contributor+ unauthorized PHP snippet creation via winp_snippet_create AJAX handler", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["code-injection", "remote-code-execution", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-25366-03": {"ajax_action": "winp_snippet_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25366", "description": "Woody ad snippets (insert-php) <=2.7.1 contributor+ unauthorized snippet deletion via winp_snippet_delete AJAX handler", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-25366-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wbcr-snippets"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|create_function)\\\\s*\\\\(|`[^`]+`|\\\\$_(?:GET|POST|REQUEST|FILES|SERVER|COOKIE)\\\\s*\\\\[|\\\\b(?:base64_decode|str_rot13|gzinflate|gzuncompress)\\\\s*\\\\(\\\\s*[\'\\"]|\\\\b(?:file_put_contents|fwrite|fputs|move_uploaded_file)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25366", "description": "Woody ad snippets (insert-php) <=2.7.1 contributor+ RCE via PHP code stored in wbcr-snippets post_content via /wp-admin/post.php", "method": "POST", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["code-injection", "remote-code-execution", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-25369-02": {"action": "init", "conditions": [{"name": "ARGS:search_referral_url", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25369", "description": "Flexmls IDX <=3.15.9 reflected XSS via unsanitized search_referral_url on listing details pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "flexmls-idx", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.15.9"}, "RULE-CVE-2026-25383-01": {"action": "init", "conditions": [{"name": "ARGS:page_url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|details|math|marquee|isindex|form|input|button|select|textarea|keygen|frameset)\\\\b[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2026-25383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25383", "description": "KiviCare Clinic Management System <=3.6.16 unauthenticated reflected XSS via page_url parameter in popupBookAppointment template", "mode": "block", "severity": 7.1, "slug": "kivicare-clinic-management-system", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25396-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ccwc_hide_notice"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25396", "description": "Commerce Coinbase for WooCommerce <=1.6.7 missing authorization on ccwc_hide_notice admin-post action allows subscriber+ option update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "commerce-coinbase-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-25418-01": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-02": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-03": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-04": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-05": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-06": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-07": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-08": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:fields", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via fields parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-09": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-10": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-11": {"ajax_action": "bitforms_entry_status_update", "conditions": [{"name": "ARGS:entryID", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via entryID parameter in bitforms_entry_status_update AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25429-01": {"ajax_action": "nexa_load_more_posts", "conditions": [{"name": "ARGS:attributes", "type": "regex", "value": "~(?:[OC]:[0-9]+:[\\"\\\\{]|(?:Tzo|Qzo)[0-9A-Za-z+/]*[=]{0,2})~"}], "cve": "CVE-2026-25429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25429", "description": "Nexa Blocks <=1.1.1 unauthenticated PHP object injection via base64-encoded attributes parameter in nexa_load_more_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "nexa-blocks", "tags": ["object-injection", "deserialization", "unauthenticated", "php-object-injection"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-25430-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^log_detail_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on log_detail AJAX action allows subscriber+ to read CRM logs and trigger reflected XSS", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^review_dismiss_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on review_dismiss AJAX action allows subscriber+ to toggle admin notice state", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^get_objects_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing capability check on get_objects AJAX action allows subscriber+ to enumerate CRM objects", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25435-01": {"ajax_action": "wpdevart_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|focus|blur|toggle|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25435", "description": "Booking Calendar <=3.2.36 unauthenticated stored XSS via wpdevart_id in wpdevart_ajax handler", "mode": "block", "severity": 7.1, "slug": "booking-calendar", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.2.36"}, "RULE-CVE-2026-25435-02": {"ajax_action": "wpdevart_form_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|focus|blur|toggle|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25435", "description": "Booking Calendar <=3.2.36 unauthenticated stored XSS via wpdevart_id in wpdevart_form_ajax handler", "mode": "block", "severity": 7.1, "slug": "booking-calendar", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.2.36"}, "RULE-CVE-2026-25435-03": {"ajax_action": "wpdevart_payment_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|focus|blur|toggle|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25435", "description": "Booking Calendar <=3.2.36 unauthenticated stored XSS via wpdevart_id in wpdevart_payment_ajax handler", "mode": "block", "severity": 7.1, "slug": "booking-calendar", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.2.36"}, "RULE-CVE-2026-25438-01": {"ajax_action": "unlimited_section_post_category_layout_block", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_category_layout_block AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-02": {"ajax_action": "unlimited_section_post_category_layout_choose_category", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_category_layout_choose_category AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-03": {"ajax_action": "unlimited_section_post_image_five_post", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_image_five_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-04": {"ajax_action": "unlimited_section_post_image_four_post", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_image_four_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-05": {"ajax_action": "unlimited_section_post_image_three_post", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_image_three_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-06": {"ajax_action": "unlimited_section_post_layout_grid", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_layout_grid AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-07": {"ajax_action": "unlimited_section_post_layout_list", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_layout_list AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25447-01": {"ajax_action": "widget_wrangler_preview", "conditions": [{"name": "ARGS:form_state", "type": "regex", "value": "~(\\\\beval\\\\b|\\\\bsystem\\\\b|shell_exec|\\\\bexec\\\\b|base64_decode|passthru|popen|proc_open|call_user_func|create_function|O:[0-9]+:|<\\\\?php)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25447", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25447", "description": "Widget Wrangler <=2.3.9 code injection via form_state in widget_wrangler_preview AJAX handler", "mode": "block", "severity": 9.1, "slug": "widget-wrangler", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": ">=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25447-02": {"ajax_action": "ww_form_ajax", "conditions": [{"name": "ARGS:context", "type": "regex", "value": "~(\\\\beval\\\\b|\\\\bsystem\\\\b|shell_exec|\\\\bexec\\\\b|base64_decode|passthru|popen|proc_open|call_user_func|create_function|O:[0-9]+:|<\\\\?php)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25447", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25447", "description": "Widget Wrangler <=2.3.9 code injection via context in ww_form_ajax AJAX handler", "mode": "block", "severity": 9.1, "slug": "widget-wrangler", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": ">=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25452-01": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:\\\\b(?:AND|OR)\\\\b(?:/\\\\*.*?\\\\*/|\\\\s|[\'\\"`()0-9]){0,32}(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])[[:space:]]*=[[:space:]]*(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])|\\\\bUN(?:/\\\\*.*?\\\\*/|\\\\s)*ION\\\\b(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT\\\\b|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b|--\\\\s*[^\\\\r\\\\n]*)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated SQL injection via remoji_id parameter in Reaction::_del", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-02": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>][^>]*onload\\\\s*=|<img[\\\\s/>][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via remoji_id parameter", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/remoji/v1/add(?:/|\\\\?|$)~"}, {"name": "ARGS:emoji", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>][^>]*onload\\\\s*=|<img[\\\\s/>][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via emoji parameter on Remoji REST add route", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "rest-api", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shipi/v1/connect/fedex/?(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25456", "description": "Automated FedEx Shipping <=5.1.8 unauthenticated access to transient nonce data via shipi/v1/connect/fedex REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "a2z-fedex-shipping", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-25471-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "exists"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 broken authentication via OTP submission on wp-login.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["authentication-bypass", "broken-authentication", "unauthenticated", "otp-bypass"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-25471-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "regex", "value": "~(?:<script[^>]*>|<img[^>]*onerror[[:space:]]*=|on(?:error|load|mouseover|click)[[:space:]]*=|javascript:)~i"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 reflected XSS via unsanitized tpsa_verify_email_otp on wp-login.php", "method": "GET", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-2554-01": {"ajax_action": "delete_wcfm_customer", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2554", "description": "WCFM <=6.7.25 IDOR allowing authenticated Vendor+ to delete arbitrary users via customerid parameter", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "authorization-bypass", "privilege-escalation"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-2568-01": {"action": "admin_init", "conditions": [{"name": "ARGS:entry_id", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via entry_id parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-02": {"action": "admin_init", "conditions": [{"name": "ARGS:start_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via start_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-03": {"action": "admin_init", "conditions": [{"name": "ARGS:end_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via end_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-04": {"action": "admin_init", "conditions": [{"name": "ARGS:vx_debug", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via vx_debug parameter on admin entry box page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2571-01": {"ajax_action": "wpdmdz_user_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2571", "description": "Download Manager <=3.3.49 missing authorization on wpdmdz_user_status AJAX handler allows subscriber+ user enumeration", "mode": "block", "severity": 4.3, "slug": "download-manager", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=3.3.49"}, "RULE-CVE-2026-2576-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment", "type": "detectSQLi"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment parameter (scalar)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[0]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[1]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter (index 1)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wopb/product-search(/|\\\\?|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2026-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2579", "description": "ProductX/WowStore <=4.4.3 unauthenticated SQL injection via search parameter in wopb/product-search REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "product-blocks", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.4.3"}, "RULE-CVE-2026-2580-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2580", "description": "WP Google Map Plugin <=4.9.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-2582-01": {"ajax_action": "show_direct_debit", "conditions": [{"name": "ARGS:account_holder", "type": "regex", "value": "~\\\\[\\\\s*[a-z_][a-z0-9_]{2,}[\\\\s\\\\]\\\\/]~"}], "cve": "CVE-2026-2582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2582", "description": "Germanized for WooCommerce <=3.20.5 unauthenticated arbitrary shortcode execution via account_holder parameter in direct debit mandate AJAX handler", "mode": "block", "severity": 6.5, "slug": "woocommerce-germanized", "tags": ["code-injection", "shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.20.5"}, "RULE-CVE-2026-2583-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:meta[blocksy_meta]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-2583-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:blocksy_meta", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in classic post editor", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-25863-01": {"ajax_action": "cf7mls_validation", "conditions": [{"name": "ARGS:_count", "type": "regex", "value": "~^\\\\d{4,}$~"}], "cve": "CVE-2026-25863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25863", "description": "Contact Form 7 Conditional Fields <=2.7.3 unauthenticated denial of service via repeater _count parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "cf7-conditional-fields", "tags": ["denial-of-service", "resource-consumption", "unauthenticated"], "target": "plugin", "versions": "<=2.7.3"}, "RULE-CVE-2026-2589-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/plugins/greenshift-animation-and-page-builder-blocks/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in plugin directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/uploads/greenshift/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2592-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "wc_zpal"}, {"name": "ARGS:Status", "type": "equals", "value": "OK"}, {"name": "ARGS:wc_order", "type": "exists"}, {"name": "ARGS:Authority", "type": "regex", "value": "~^[A-Za-z0-9]{16,35}$~"}], "cve": "CVE-2026-2592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2592", "description": "ZarinPal WooCommerce Payment Gateway <=5.0.16 improper access control via wc-api wc_zpal callback with forged short Authority token", "mode": "block", "severity": 7.7, "slug": "zarinpal-woocommerce-payment-gateway", "tags": ["improper-access-control", "payment-bypass", "woocommerce-api", "unauthenticated"], "target": "plugin", "versions": "<=5.0.16"}, "RULE-CVE-2026-2593-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:meta[_gspb_post_css]", "type": "regex", "value": "~</?[a-zA-Z][a-zA-Z0-9]*[\\\\s/>]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css post meta through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~greenshift-blocks/element[^}]*dynamicAttributes[^}]*<[a-zA-Z][a-zA-Z0-9]*[ /][^>]*(?:on[a-zA-Z]+=|javascript:|<script)~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via dynamicAttributes in block content through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "rest-api", "block-editor"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2593-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:meta[_gspb_post_css]", "type": "regex", "value": "~</?[a-zA-Z][a-zA-Z0-9]*[\\\\s/>]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css meta through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "classic-editor"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2599-01": {"action": "init", "conditions": [{"name": "ARGS:vx_crm_form_action", "type": "equals", "value": "download_csv"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2599", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2599", "description": "Contact Form Entries <=1.4.7 unauthenticated PHP Object Injection via download_csv deserialization trigger", "method": "GET", "mode": "block", "severity": 9.8, "slug": "contact-form-entries", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.4.7"}, "RULE-CVE-2026-2628-01": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^[A-Za-z0-9_=-]+\\\\.[A-Za-z0-9_=-]+\\\\.?[A-Za-z0-9_=-]*$~"}, {"name": "ARGS:code", "type": "exists"}], "cve": "CVE-2026-2628", "method": "GET", "mode": "block", "severity": 9.8, "slug": "login-with-azure", "target": "plugin", "versions": "<2.2.6"}, "RULE-CVE-2026-2631-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/datalogics/v1/(?:token|update)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[^a-z0-9_])(?:users_can_register|default_role|siteurl|admin_email)(?:[^a-z0-9_]|$)~i"}], "cve": "CVE-2026-2631", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2631", "description": "Datalogics <=2.6.59 arbitrary WordPress option update via Datalogics REST namespace", "method": "POST", "mode": "block", "severity": 9.8, "slug": "datalogics", "tags": ["privilege-escalation", "arbitrary-option-update", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.6.59"}, "RULE-CVE-2026-27044-01": {"ajax_action": "totalpoll_modules_install_from_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27044", "description": "Total Poll Lite <=4.12.0 authenticated remote code execution via totalpoll_modules_install_from_file AJAX handler", "mode": "block", "severity": 9.9, "slug": "totalpoll-lite", "tags": ["remote-code-execution", "code-injection", "missing-authorization"], "target": "plugin", "versions": "<=4.12.0"}, "RULE-CVE-2026-27053-01": {"ajax_action": "vwls_stream_setup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream_setup AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-02": {"ajax_action": "h5vls_app", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via h5vls_app AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-03": {"ajax_action": "vwls_stream", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27067-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_media REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_font(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_font REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27068-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:llms_generator_settings", "type": "regex", "value": "~(?:<script[^>]*>|</script>|javascript\\\\s*:|on[a-z]+\\\\s*=|<iframe[^>]*>|<svg[^>]*>)~i"}], "cve": "CVE-2026-27068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27068", "description": "Website LLMs.txt <=8.2.6 reflected XSS via llms_generator_settings reflected in admin/admin-page.php hidden input attributes", "mode": "block", "severity": 7.1, "slug": "website-llms-txt", "tags": ["xss", "reflected-xss", "admin-page", "crafted-link"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2026-2707-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/weforms/v1/forms/[0-9]+/entries(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-2707-02": {"ajax_action": "weforms_frontend_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through AJAX frontend submit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-27071-01": {"ajax_action": "save_location", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27071", "description": "WPCafe <=3.0.6 unauthenticated broken access control on save_location AJAX handler", "mode": "block", "severity": 9.1, "slug": "wp-cafe", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2026-27072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_head", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_head parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27072-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_footer", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_footer parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27075-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27077-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27077-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27078-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27078-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27080-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27080-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27081-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27081-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27082-01": {"ajax_action": "lovestory_options_import", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_import AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27082-02": {"ajax_action": "lovestory_options_save", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_save AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27094-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:coblocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer\\\\w+)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27094", "description": "CoBlocks <=3.1.16 Contributor+ stored XSS via CoBlocks block attributes in post content", "mode": "block", "severity": 6.5, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-27095-04": {"ajax_action": "get_wbtm_return_date", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_return_date AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-05": {"ajax_action": "get_wbtm_dropping_point", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_dropping_point AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-06": {"ajax_action": "wbtm_create_seat_plan", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-07": {"ajax_action": "wbtm_create_seat_plan_dd", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan_dd AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-08": {"ajax_action": "wbtm_get_bus_detail", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_get_bus_detail AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-09": {"ajax_action": "wbtm_reload_pricing", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_reload_pricing AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-27097-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-2712-01": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp-optimize-heartbeat-smush][command]", "type": "regex", "value": "~^(?:get_smush_logs|clean_all_backup_images|process_bulk_smush|update_smush_options|get_smush_options|clear_smush_stats|clear_backup_images|clear_backup_images_directory|delete_log_files|get_logfile_path)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2712", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2712", "description": "WP-Optimize <=4.5.0 missing authorization in receive_heartbeat() allows subscriber+ to invoke admin-only Smush commands via Heartbeat API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-optimize", "tags": ["incorrect-authorization", "missing-capability", "heartbeat-abuse"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2718-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2720-01": {"ajax_action": "hrp-fetch-employees", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2720", "description": "HR Press Lite <=1.0.2 missing authorization on hrp-fetch-employees AJAX action allows subscriber+ sensitive employee data exposure", "mode": "block", "severity": 6.5, "slug": "hr-press-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-2721-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:mailarchiver_archiver_privacy_encryption", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|<i(?:mg|frame)[\\\\s/]|</(?:title|textarea|style)>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2721", "description": "MailArchiver <=4.4.0 authenticated stored XSS via mailarchiver_archiver_privacy_encryption settings field", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mailarchiver", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=4.4.0"}, "RULE-CVE-2026-2724-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "unitecreator_ajax_action"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2026-2724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2724", "description": "Unlimited Elements for Elementor <=2.0.5 unauthenticated stored XSS via form field values", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["xss", "stored-xss", "unauthenticated", "elementor"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-2732-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_prepare_remove_background"}, {"name": "ARGS:attachment_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background GET handler allows Author+ to access arbitrary attachments", "method": "GET", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-2732-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_process_remove_background"}, {"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background POST handler allows Author+ to replace arbitrary attachments", "method": "POST", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-27326-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27326-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27333-01": {"ajax_action": "vmls_app", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls_app AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27333-02": {"ajax_action": "vmls", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27335-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27335-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27337-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27337-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27339-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27339-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27340-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27341-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27341-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27353-01": {"ajax_action": "grandnews_ppb", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-27353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27353", "description": "Grand News Theme <=3.4.3 unauthenticated reflected XSS via shortcode parameter", "method": "POST", "mode": "block", "severity": 7.1, "slug": "grandnews", "tags": ["xss", "reflected", "unauthenticated"], "target": "theme", "versions": "<=3.4.3"}, "RULE-CVE-2026-27353-02": {"ajax_action": "grandnews_ppb", "conditions": [{"name": "ARGS:rel", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-27353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27353", "description": "Grand News Theme <=3.4.3 unauthenticated reflected XSS via rel parameter", "method": "POST", "mode": "block", "severity": 7.1, "slug": "grandnews", "tags": ["xss", "reflected", "unauthenticated"], "target": "theme", "versions": "<=3.4.3"}, "RULE-CVE-2026-27366-01": {"action": "init", "conditions": [{"name": "ARGS:mainwpsignature", "type": "exists"}, {"name": "ARGS:register", "type": "exists"}], "cve": "CVE-2026-27366", "description": "MainWP Child <=6.1.1 unauthenticated broken access control via site registration flow", "mode": "block", "severity": 7.5, "slug": "mainwp-child", "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-27369-01": {"ajax_action": "bt_bb_get_grid_portfolio", "conditions": [{"name": "ARGS:show", "type": "regex", "value": "~^[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2026-27369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27369", "description": "Celeste Theme <=1.3.6 unauthenticated PHP object injection via show parameter in bt_bb_get_grid_portfolio AJAX handler", "mode": "block", "severity": 8.1, "slug": "celeste", "tags": ["object-injection", "php-deserialization", "unauthenticated"], "target": "theme", "versions": "<=1.3.6"}, "RULE-CVE-2026-27379-01": {"ajax_action": "nxs_saveSiteSets", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_saveSiteSets AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27379-02": {"ajax_action": "nxs_snap_aj", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_snap_aj AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27384-01": {"ajax_action": "w3tc_dismiss_license_notice", "conditions": [{"name": "ARGS:notice_id", "type": "detectSQLi"}], "cve": "CVE-2026-27384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27384", "description": "W3 Total Cache <=2.9.1 authenticated SQL injection via notice_id in w3tc_dismiss_license_notice AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2026-27410-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via slimtrack AJAX tracker endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27410-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/slimstat/v1/hit(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via REST slimstat/v1/hit endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27421-01": {"ajax_action": "count_compare_items", "conditions": [{"name": "ARGS:compare_empty_text", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<[^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via count_compare_items \\u2013 blocks unauthenticated/low-priv requests containing XSS payloads in compare_empty_text echoed without escaping in includes/compare.php:621", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-02": {"ajax_action": "wpr_woo_grid_filters_ajax", "conditions": [{"name": "ARGS:grid_settings[/\\\\w+/]", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<[^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_woo_grid_filters_ajax \\u2013 blocks unauthenticated requests injecting XSS in grid_settings array values rendered without escaping in wpr-templates-data.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-03": {"ajax_action": "wpr_load_more_tweets", "conditions": [{"name": "ARGS:wpr_load_more_settings[/\\\\w+/]", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<[^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_load_more_tweets \\u2013 blocks unauthenticated requests injecting XSS in wpr_load_more_settings array values rendered without escaping in wpr-load-more-tweets.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27984-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:system|passthru|exec|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace|create_function|call_user_func|call_user_func_array|file_get_contents|file_put_contents|fopen|fwrite|include|require|phpinfo|unlink|rmdir|mail|header|curl_exec|base64_decode)[ ]*[(]~i"}], "cve": "CVE-2026-27984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27984", "description": "Widget Options <=4.1.3 authenticated code injection via widgetopts_ajax_validate_expression AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "widget-options", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": "<=4.1.3"}, "RULE-CVE-2026-27986-01": {"ajax_action": "ostende_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-27986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27986", "description": "OsTende theme <=1.4.3 unauthenticated LFI via ostende_ajax_get_posts AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "ostende", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "php-file-inclusion"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2026-27986-02": {"ajax_action": "ostende_get_linked_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-27986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27986", "description": "OsTende theme <=1.4.3 unauthenticated LFI via ostende_get_linked_data AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "ostende", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "php-file-inclusion"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2026-27988-01": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-02": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-03": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin skin parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-04": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin file parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-05": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-06": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27989-01": {"ajax_action": "quanzo_switch_skin", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|file|phar)://)~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 local file inclusion via quanzo_switch_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "path-traversal", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-27989-02": {"ajax_action": "quanzo_download_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~^(?!https?://[\\\\w.-]+(?:/[\\\\w. -]*)?\\\\.zip$).+~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 remote/local file inclusion via quanzo_download_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "remote-file-inclusion", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-27989-03": {"ajax_action": "quanzo_buy_skin", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|file|phar)://)~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 local file inclusion via quanzo_buy_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "path-traversal", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-27989-04": {"ajax_action": "quanzo_update_skin", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|file|phar)://)~i"}, {"type": "missing_capability", "value": "edit_themes"}], "cve": "CVE-2026-27989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27989", "description": "Quanzo Theme <=1.0.10 local file inclusion via quanzo_update_skin AJAX handler", "mode": "block", "severity": 8.1, "slug": "quanzo", "tags": ["local-file-inclusion", "path-traversal", "missing-authorization"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-28015-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|file|phar|expect|zip|data)://)~i"}], "cve": "CVE-2026-28015", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28015", "description": "ShiftCV Theme <=3.0.14 unauthenticated LFI via path traversal in layout/skin/template parameters (fixed during pagination in 3.0.15)", "mode": "block", "severity": 8.1, "slug": "shift-cv", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=3.0.14"}, "RULE-CVE-2026-28024-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28024-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28030-01": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-02": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-03": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-04": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-05": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (theme param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-06": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:product_id", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (product_id param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-07": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-08": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-09": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-10": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28039-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via table config language/column type setting (require_once with unsanitized path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via plugin settings language parameter (require_once with unsanitized wdtInterfaceLanguage)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-03": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-04": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart show engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-05": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 unauthenticated SSRF/LFI via cache update file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "unauthenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-06": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 SSRF/LFI via nested JSON roots file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28041-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28041-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28043-01": {"ajax_action": "healer_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|/proc/self)|\\\\.\\\\. %25(?:2[Ff]|5[Cc]))~i"}], "cve": "CVE-2026-28043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28043", "description": "Healer theme <=1.0.0 unauthenticated local file inclusion via healer_ajax_get_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "healer", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "php-stream-wrapper"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-28048-01": {"action": "init", "conditions": [{"name": "ARGS:flashtemplate", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28048", "description": "FlashMart Theme <=2.0.15 unauthenticated local file inclusion via template parameter", "mode": "block", "severity": 8.1, "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "core", "versions": ">=5.0"}, "RULE-CVE-2026-28049-01": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via template parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-02": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via page parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-03": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via file parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-04": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via include parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28060-01": {"ajax_action": "stephanie_king_get_linked_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[A-Za-z]:\\\\\\\\)~i"}], "cve": "CVE-2026-28060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28060", "description": "S.King <=1.5.3 unauthenticated local file inclusion via stephanie_king_get_linked_data AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "stephanie-king", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "ajax"], "target": "theme", "versions": "<=1.5.3"}, "RULE-CVE-2026-28060-02": {"ajax_action": "stephanie_king_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[A-Za-z]:\\\\\\\\)~i"}], "cve": "CVE-2026-28060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28060", "description": "S.King <=1.5.3 unauthenticated local file inclusion via stephanie_king_ajax_get_posts AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "stephanie-king", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "ajax"], "target": "theme", "versions": "<=1.5.3"}, "RULE-CVE-2026-28065-01": {"action": "init", "conditions": [{"name": "ARGS:section", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via section param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28065-02": {"action": "init", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via template param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28065-03": {"action": "init", "conditions": [{"name": "ARGS:stylesheet", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via stylesheet param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28065-04": {"action": "init", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28065", "description": "Eject Theme <=2.17 unauthenticated local file inclusion via file param", "method": "GET", "mode": "block", "severity": 8.1, "slug": "eject", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28096-01": {"ajax_action": "wealthco_ajax_get_posts", "conditions": [{"name": "ARGS:/^(blog_template|template|template_name|file_name|file|tpl)$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28096", "description": "WealthCo Theme <=2.18 unauthenticated local file inclusion via wealthco_ajax_get_posts AJAX", "mode": "block", "severity": 8.1, "slug": "wealthco", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.18"}, "RULE-CVE-2026-28098-01": {"ajax_action": "save_life_get_linked_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc[\\\\\\\\/]self[\\\\\\\\/]|boot[\\\\\\\\/]grub))~i"}], "cve": "CVE-2026-28098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28098", "description": "Save Life <=1.2.13 unauthenticated local file inclusion via save_life_get_linked_data AJAX handler", "mode": "block", "severity": 8.1, "slug": "save-life", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28098-02": {"ajax_action": "save_life_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|proc[\\\\\\\\/]self[\\\\\\\\/]|boot[\\\\\\\\/]grub))~i"}], "cve": "CVE-2026-28098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28098", "description": "Save Life <=1.2.13 unauthenticated local file inclusion via save_life_ajax_get_posts AJAX handler", "mode": "block", "severity": 8.1, "slug": "save-life", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28117-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28117-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28118-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28118-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "nir_vana", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28119-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "nir_vana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28121-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28121-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28125-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28129-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28133-02": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~<[?%](?:php|=)~i"}], "cve": "CVE-2026-28133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28133", "description": "Filr Protection <=1.2.14 arbitrary file write via chunked upload (_chunkedd) in upload_file AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "filr-protection", "tags": ["arbitrary-file-upload", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=1.2.14"}, "RULE-CVE-2026-28175-01": {"action": "admin_init", "conditions": [{"name": "ARGS:from_dt", "type": "regex", "value": "~[\\"\']\\\\s*>|<script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-28175", "description": "Visitors Traffic Real-Time Statistics <=8.11 reflected XSS via unescaped from_dt parameter on the admin overview page", "mode": "block", "severity": 7.1, "slug": "visitors-traffic-real-time-statistics", "target": "plugin", "versions": "<=8.11"}, "RULE-CVE-2026-28175-02": {"action": "admin_init", "conditions": [{"name": "ARGS:to_dt", "type": "regex", "value": "~[\\"\']\\\\s*>|<script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-28175", "description": "Visitors Traffic Real-Time Statistics <=8.11 reflected XSS via unescaped to_dt parameter on the admin overview page", "mode": "block", "severity": 7.1, "slug": "visitors-traffic-real-time-statistics", "target": "plugin", "versions": "<=8.11"}, "RULE-CVE-2026-28176-01": {"ajax_action": "bookactiRefundBookings", "conditions": [{"name": "ARGS:refund_message", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-28176", "description": "Booking Activities <=1.18.4 unauthenticated PHP object injection via refund_message parameter in bookactiRefundBookings AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-activities", "target": "plugin", "versions": "<=1.18.4"}, "RULE-CVE-2026-28176-02": {"ajax_action": "bookactiUpdateForm", "conditions": [{"name": "ARGS:form_title", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-28176", "description": "Booking Activities <=1.18.4 PHP object injection via form_title parameter in bookactiUpdateForm AJAX handler", "mode": "block", "severity": 8.8, "slug": "booking-activities", "target": "plugin", "versions": "<=1.18.4"}, "RULE-CVE-2026-2826-01": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-2826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2826", "description": "Kadence Blocks <=3.6.4 missing authorization on kadence_import_process_pattern allows authenticated users without upload_files capability to import arbitrary content", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2026-2830-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2830-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:logid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via logid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2831-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:eventid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via eventid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2837-01": {"ajax_action": "ric_plugin_save_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2837", "description": "Ricerca Smart Search <=1.1.12 authenticated stored XSS via plugin settings in ric_plugin_save_settings", "mode": "block", "severity": 4.4, "slug": "ricerca-smart-search", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2026-2840-01": {"action": "init", "conditions": [{"name": "ARGS:eeb_mail", "type": "regex", "value": "~<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:~i"}], "cve": "CVE-2026-2840", "description": "Email Encoder Bundle <=2.4.4 reflected XSS via eeb_mail parameter in eeb_mailto shortcode", "mode": "block", "severity": 6.4, "slug": "email-encoder-bundle", "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-28557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpforo_synch_roles"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-28557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28557", "description": "wpForo Forum >=2.4.0 <2.4.16 missing authorization on wpforo_synch_roles AJAX handler allows privilege escalation via bulk usergroup-to-role reassignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control", "role-remapping"], "target": "plugin", "versions": ">=2.4.0 <2.4.16"}, "RULE-CVE-2026-28562-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-28562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28562", "description": "wpForo Forum >=2.4.0 <2.4.15 unauthenticated SQL injection via wpfob ORDER BY parameter", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": ">=2.4.0 <2.4.15"}, "RULE-CVE-2026-2868-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|admin-ajax)\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\son[a-z]+\\\\s*=|<img[^>]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute persisted via classic post save / admin-ajax", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\son[a-z]+\\\\s*=|<img[^>]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute through REST API post save", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2879-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/getgenie/v1/geniechat(?:/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2879", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2879", "description": "GetGenie <=4.3.2 authenticated (Author+) IDOR allows arbitrary post overwrite via id parameter in getgenie/v1/chat REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "getgenie", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-2890-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s+on[a-zA-Z]+=|<script[^>]*>|javascript\\\\s*:|<iframe[^>]*>|<object[^>]*>|<embed[^>]*>|<svg[^>]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-2890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2890", "description": "Formidable Forms <=6.28 reflected/stored XSS via item_meta in form preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "formidable", "tags": ["xss", "unauthenticated", "reflected-xss"], "target": "plugin", "versions": "<=6.28"}, "RULE-CVE-2026-2918-01": {"ajax_action": "ha_condition_update", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\'] *on[a-z]+ *=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2918", "description": "Happy Elementor Addons <=3.21.0 IDOR + Stored XSS via ha_condition_update AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["idor", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-2924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>]|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2924-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>]|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2936-03": {"ajax_action": "today_traffic_index", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*><script\\\\b|\'\\\\s*><script\\\\b|<script\\\\b[^>]*>.*?</script\\\\s*>|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in today_traffic_index AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2936-04": {"ajax_action": "visits_time_graph", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*><script\\\\b|\'\\\\s*><script\\\\b|<script\\\\b[^>]*>.*?</script\\\\s*>|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in visits_time_graph AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2941-01": {"ajax_action": "linksy_search_and_replace_item_details", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "set"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_item_details allowing subscriber+ arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-02": {"ajax_action": "linksy_search_and_replace_replace_db", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_replace_db allowing subscriber+ bulk arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-03": {"ajax_action": "linksy_search_and_replace_fetch_db_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_fetch_db_list allowing subscriber+ database table enumeration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2942-01": {"ajax_action": "proSol_fileUploadProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2942-02": {"ajax_action": "proSol_fileUploadModalProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadModalProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2948-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-client/v2/import/images(?:[/?&]|$)~"}, {"name": "ARGS:imageUrl", "type": "regex", "value": "~^(?:ftp|file|dict|gopher|ssh|smtp|news|telnet|nntp|irc|imap|mongo):|^(?:https?:)?//(?:localhost|127\\\\.0\\\\.0\\\\.1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.169\\\\.254|0\\\\.0\\\\.0\\\\.0|/|[a-zA-Z]:\\\\\\\\|[a-zA-Z0-9.-]+\\\\.internal)~i"}], "cve": "CVE-2026-2948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2948", "description": "Gutenverse <=3.5.3 server-side request forgery via imageUrl in import_images REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2951-01": {"ajax_action": "gutentor_deactivate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_deactivate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-02": {"ajax_action": "gutentor_activate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_activate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-03": {"ajax_action": "gutentor_bulk_activate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_activate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-04": {"ajax_action": "gutentor_bulk_deactivate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_deactivate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2987-01": {"action": "init", "conditions": [{"name": "ARGS:sac_text", "type": "exists"}, {"name": "ARGS:sac_text", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/][^>]*on[a-z]+=|<img[\\\\s/][^>]*on(?:error|load)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-2987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2987", "description": "Simple Ajax Chat <=20260217 unauthenticated stored XSS via chat message", "method": "POST", "mode": "block", "severity": 6.1, "slug": "simple-ajax-chat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=20260217"}, "RULE-CVE-2026-2991-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kivicare/v1/auth/patient/social-login([/?&]|$)~i"}], "cve": "CVE-2026-2991", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2991", "description": "KiviCare <=4.1.2 unauthenticated authentication bypass via patient-social-login REST endpoint \\u2014 vendor deleted the entire endpoint in fix", "method": "POST", "mode": "block", "severity": 9.8, "slug": "kivicare-clinic-management-system", "tags": ["authentication-bypass", "unauthenticated", "rest-api", "improper-authentication"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2026-2992-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kivicare/v1/setup-wizard/clinic([/?&]|$)~"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2992", "description": "KiviCare Clinic Management System <=4.1.2 missing authorization on setup wizard clinic REST endpoint", "method": "POST", "mode": "block", "severity": 8.2, "slug": "kivicare-clinic-management-system", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2026-2992-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kivicare/v1/setup-wizard/step-complete([/?&]|$)~"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2992", "description": "KiviCare Clinic Management System <=4.1.2 missing authorization on setup wizard step-complete REST endpoint", "method": "POST", "mode": "block", "severity": 8.2, "slug": "kivicare-clinic-management-system", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2026-2993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:table", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 missing authorization on waic_* AJAX actions allows unauthenticated access to getListForTbl data endpoint", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["missing-authorization", "sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via orderby parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'[^\']*\'\\\\s*=\\\\s*\'[^\']*\'|\\\\b(?:OR|AND)\\\\s+1\\\\s*=\\\\s*1)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via search parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2996-01": {"action": "init", "conditions": [{"name": "ARGS:add-to-cart", "type": "exists"}, {"name": "ARGS:wapf_field_groups", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-2996", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2996", "description": "Advanced Product Fields for WooCommerce <=1.6.21 improper input validation allows required paid addon price bypass via blank wapf_field_groups on add-to-cart", "mode": "block", "severity": 7.5, "slug": "advanced-product-fields-for-woocommerce", "tags": ["improper-input-validation", "business-logic", "price-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=1.6.21"}, "RULE-CVE-2026-3003-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vagaro_command", "type": "regex", "value": "~^(?:Add|Update)$~i"}, {"name": "ARGS:vagaro_code", "type": "regex", "value": "~(?:<(?:script|svg|math|embed|object)[^>]*|&#(?:0*60|x0*3c);?(?:script|svg|math|embed|object)|on[a-z]{3,16}[[:space:]]*=|javascript[[:space:]]*:|&#(?:0*106|x0*6a);?&#(?:0*97|x0*61);?&#(?:0*118|x0*76);?&#(?:0*97|x0*61);?&#(?:0*115|x0*73);?&#(?:0*99|x0*63);?&#(?:0*114|x0*72);?&#(?:0*105|x0*69);?&#(?:0*112|x0*70);?&#(?:0*116|x0*74);?[[:space:]]*:)~i"}], "cve": "CVE-2026-3003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3003", "description": "Vagaro Booking Widget <=0.3 unauthenticated stored XSS via vagaro_code on admin_init POST handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "vagaro-booking-widget", "tags": ["xss", "stored-xss", "unauthenticated", "admin-post"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-3018-01": {"ajax_action": "newsletters_api", "conditions": [{"name": "ARGS:wpmlsubscriber_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-3018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3018", "description": "Newsletters <=4.13 unauthenticated time-based SQL injection via wpmlsubscriber_id parameter in newsletters_api AJAX handler", "mode": "block", "severity": 7.5, "slug": "newsletters-lite", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-3056-01": {"ajax_action": "seraph_accel_api", "conditions": [{"name": "ARGS:fn", "type": "equals", "value": "LogClear"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3056", "description": "Seraphinite Accelerator <=2.28.14 missing authorization on LogClear via seraph_accel_api AJAX handler", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "seraph_accel_api"}, {"name": "ARGS:fn", "type": "equals", "value": "GetData"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3058", "description": "Seraphinite Accelerator <=2.28.14 unauthenticated sensitive information exposure via admin-post.php nopriv route with fn=GetData", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3090-01": {"ajax_action": "ps-get-email-logs", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<script|</script|<[^>]+on[a-zA-Z]+[[:space:]]*=|javascript[[:space:]]*:)~i"}], "cve": "CVE-2026-3090", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3090", "description": "Post SMTP <=3.8.0 stored XSS via unescaped event_type rendering in ps-get-email-logs AJAX response", "method": "POST", "mode": "block", "severity": 7.2, "slug": "post-smtp", "tags": ["xss", "stored-xss", "ajax", "email-logs"], "target": "plugin", "versions": "<=3.8.0"}, "RULE-CVE-2026-3098-01": {"ajax_action": "smart-slider3", "conditions": [{"name": "ARGS:nextendcontroller", "type": "regex", "value": "~^sliders?$~i"}, {"name": "ARGS:nextendaction", "type": "regex", "value": "~^export~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3098", "description": "Smart Slider 3 <=3.5.1.33 arbitrary file read via export \\u2014 restricts slider export to admins only (blocks subscriber/editor-level exploitation)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "smart-slider-3", "tags": ["arbitrary-file-read", "lfi", "missing-authorization"], "target": "plugin", "versions": "<=3.5.1.33"}, "RULE-CVE-2026-3129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img\\\\b(?:[^>]|\\\\r|\\\\n)*\\\\bon[a-z]{3,20}\\\\s*=~i"}], "cve": "CVE-2026-3129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3129", "description": "LiteSpeed Cache <=7.7 stored XSS via crafted img tag attributes bypassing Lazy Load Images width/height stripping regex; blocks malicious img event-handler payloads submitted in post content by Author-level accounts", "mode": "block", "severity": 6.4, "slug": "litespeed-cache", "tags": ["xss", "stored", "authenticated", "content-injection"], "target": "plugin", "versions": "<=7.7"}, "RULE-CVE-2026-3129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<img\\\\b(?:[^>]|\\\\r|\\\\n)*\\\\bon[a-z]{3,20}\\\\s*=~i"}], "cve": "CVE-2026-3129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3129", "description": "LiteSpeed Cache <=7.7 stored XSS via crafted img tag attributes bypassing Lazy Load Images width/height stripping regex; blocks malicious img event-handler payloads submitted in post content by Author-level accounts", "mode": "block", "severity": 6.4, "slug": "litespeed-cache", "tags": ["xss", "stored", "authenticated", "content-injection"], "target": "plugin", "versions": "<=7.7"}, "RULE-CVE-2026-3132-01": {"ajax_action": "jltma_widget_render_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_render_preview AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-02": {"ajax_action": "jltma_widget_save_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_save_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-03": {"ajax_action": "jltma_widget_get_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized data access via jltma_widget_get_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-04": {"ajax_action": "jltma_widget_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized widget deletion via jltma_widget_delete AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-05": {"ajax_action": "jltma_widget_update_category", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized category update via jltma_widget_update_category AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-06": {"ajax_action": "jltma_widget_get_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions read via jltma_widget_get_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-07": {"ajax_action": "jltma_widget_save_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions save via jltma_widget_save_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3138-01": {"ajax_action": "delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3138", "description": "Product Filter for WooCommerce by WBW <=3.1.2 missing authorization on delete AJAX handler allows unauthenticated filter data deletion", "mode": "block", "severity": 6.5, "slug": "woo-product-filter", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-3143-01": {"ajax_action": "boldgrid_cli_cancel_rollback", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-3143", "description": "Total Upkeep (boldgrid-backup) <=1.17.1 missing authorization on boldgrid_cli_cancel_rollback AJAX action allows unauthenticated rollback cancellation", "mode": "block", "severity": 5.3, "slug": "boldgrid-backup", "target": "plugin", "versions": "<=1.17.1"}, "RULE-CVE-2026-3174-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/commerce/stripe/return~i"}, {"name": "ARGS:stripe", "type": "exists"}], "cve": "CVE-2026-3174", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3174", "description": "Event Tickets and Registration <=5.27.4 unauthenticated Stripe merchant credential overwrite via public GET to the Stripe OAuth return endpoint (permission_callback __return_true)", "mode": "block", "severity": 7.5, "slug": "event-tickets", "tags": ["missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.27.4"}, "RULE-CVE-2026-3178-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|&lt;|&gt;~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_name parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3178-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|&lt;|&gt;~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_description parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3180-01": {"ajax_action": "post_cg1l_resend_unconfirmed_mail_frontend", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg1l_resend_unconfirmed_mail_frontend", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-03": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordEmail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.3 unauthenticated SQL injection via cgLostPasswordEmail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.3"}, "RULE-CVE-2026-31921-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcpr(?:update|settings_update)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprupdate REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-31921-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcprsettings_update(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprsettings_update REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-3222-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:location_id", "type": "regex", "value": "~(?:UNION[^a-zA-Z]+(?:ALL[^a-zA-Z]+)?SELECT|(?:AND|OR)[^a-zA-Z]+(?:SLEEP|BENCHMARK|IF|CASE)[^a-zA-Z]*[(]|(?:AND|OR)[^a-zA-Z]+[0-9]+[^a-zA-Z]*=[^a-zA-Z]*[0-9]|SLEEP[^a-zA-Z]*[(]|BENCHMARK[^a-zA-Z]*[(])~i"}], "cve": "CVE-2026-3222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3222", "description": "WP Maps <=4.9.1 unauthenticated time-based blind SQL injection via location_id parameter in wpgmp_ajax_call AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-3226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/send-email(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3226", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3226", "description": "LearnPress <=4.3.2.8 missing authorization on SendEmailAjax REST endpoints allows Subscriber+ to trigger arbitrary email notifications", "method": "POST", "mode": "block", "severity": 4.3, "slug": "learnpress", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-3228-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:snapFB", "type": "regex", "value": "~(?:<script[ />]|<svg[ />]|on(?:error|load|click|mouseover|focus)[ ]*=|javascript[ ]*:)~i"}], "cve": "CVE-2026-3228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3228", "description": "NextScripts: Social Networks Auto-Poster <=4.4.6 Stored XSS via snapFB post meta parameter during post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-32358-01": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_booking_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via date interval parameters in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-32358-02": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_modification_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via modification date interval parameter in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-3239-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-3239-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-32399-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[s] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[order] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-04": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[post_mime_type]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[post_mime_type] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32413-01": {"ajax_action": "pm_get_uri_editor", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe)[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 reflected XSS via post_id parameter in pm_get_uri_editor Gutenberg endpoint", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-02": {"ajax_action": "pm_bulk_tools", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_bulk_tools allows subscriber+ privilege escalation", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-03": {"ajax_action": "pm_detect_duplicates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_detect_duplicates allows subscriber+ data access", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32414-01": {"ajax_action": "awl-getRuleGroup", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getRuleGroup AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-02": {"ajax_action": "awl-getSuboptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSuboptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-03": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-04": {"ajax_action": "awl-changeLabelStatus", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-changeLabelStatus AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-05": {"ajax_action": "awl-showCurrentHooks", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-showCurrentHooks AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32423-01": {"ajax_action": "svg_get_attachment_url", "conditions": [{"name": "ARGS:attachmentID", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32423", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32423", "description": "Admin Site Enhancements <=8.4.0 missing authorization on svg_get_attachment_url allows contributor+ access to arbitrary attachment URLs", "method": "POST", "mode": "block", "severity": 5.4, "slug": "admin-site-enhancements", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=8.4.0"}, "RULE-CVE-2026-3243-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/amem/avatar/v1/crop(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via REST /amem/avatar/v1/crop leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-3243-02": {"ajax_action": "amem_avatar_crop", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via amem_avatar_crop AJAX handler leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "ajax"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-32441-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized comment export via catch_export_request on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32441-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized settings modification via catch_save_settings on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32459-01": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:order_by", "type": "regex", "value": "~[^a-zA-Z0-9_-]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via order_by parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-02": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:limit", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via limit parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-03": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via offset parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32461-01": {"ajax_action": "rsssl_force_confirm_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_force_confirm_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32461-02": {"ajax_action": "rsssl_resend_verification_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_resend_verification_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32463-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/sps/v1/data[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/sps_select_website|sps_website/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|(?:php|phar|data|expect|zip|glob)://)~i"}], "cve": "CVE-2026-32463", "description": "Sync Post With Other Site <=1.9.3 path traversal/LFI via sps_website and sps_select_website REST parameters at /wp-json/sps/v1/data", "mode": "block", "slug": "sync-post-with-other-site", "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2026-32463-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/sps/v1/data[\\\\\\\\/]*$~i"}, {"name": "ARGS:/sps_select_website|sps_website/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|(?:php|phar|data|expect|zip|glob)://)~i"}], "cve": "CVE-2026-32463", "description": "Sync Post With Other Site <=1.9.3 path traversal/LFI via sps_website and sps_select_website REST parameters at /wp-json/sps/v1/data", "mode": "block", "slug": "sync-post-with-other-site", "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2026-32465-01": {"ajax_action": "ere_update_profile_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-32465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32465", "description": "Essential Real Estate <=5.3.3 authenticated (Customer) PHP Object Injection via ere_update_profile_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2026-32465-02": {"ajax_action": "ere_register_user_as_agent_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-32465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32465", "description": "Essential Real Estate <=5.3.3 authenticated (Customer) PHP Object Injection via ere_register_user_as_agent_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2026-32465-03": {"ajax_action": "ere_change_password_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-32465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32465", "description": "Essential Real Estate <=5.3.3 authenticated (Customer) PHP Object Injection via ere_change_password_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2026-32475-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_pro_forms_send_form"}, {"name": "FILES:form_fields", "type": "regex", "value": "~\\\\.(?:phtml?|phps?|php[3-8]|phpt|phar|pht|shtml?|html?|hta|aspx?|swf|jar|exe|com|cmd|csh|bat)[\\\\s.]*$~i"}], "cve": "CVE-2026-32475", "cve_link": "https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability", "description": "Elementor Pro unauthenticated arbitrary file upload to RCE through the Forms module File Upload field, blocked at the admin-ajax form-submission endpoint when any submitted file part carries a server-executable extension.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "elementor-pro", "tags": ["arbitrary-file-upload", "unrestricted-file-upload", "remote-code-execution", "unauthenticated", "cwe-434", "elementor-pro", "forms-module"], "target": "plugin", "versions": "<4.2.2"}, "RULE-CVE-2026-32475-02": {"ajax_action": "elementor_pro_forms_send_form", "conditions": [{"name": "FILES:form_fields", "type": "regex", "value": "~\\\\.(?:phtml?|phps?|php[3-8]|phpt|phar|pht|shtml?|html?|hta|aspx?|swf|jar|exe|com|cmd|csh|bat)[\\\\s.]*$~i"}], "cve": "CVE-2026-32475", "cve_link": "https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability", "description": "Elementor Pro unauthenticated arbitrary file upload to RCE through the Forms module File Upload field, blocked on the form-submission AJAX hook itself so the protection does not depend on the request URI or on where the action parameter is carried.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "elementor-pro", "tags": ["arbitrary-file-upload", "unrestricted-file-upload", "remote-code-execution", "unauthenticated", "cwe-434", "elementor-pro", "forms-module"], "target": "plugin", "versions": "<4.2.2"}, "RULE-CVE-2026-32482-01": {"ajax_action": "ona_activate_child_theme", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)|\\\\.[Pp][Hh](?:[Pp]\\\\d?|[Ss]|[Tt](?:ml)?|[Aa][Rr]))~"}, {"type": "missing_capability", "value": "switch_themes"}], "cve": "CVE-2026-32482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32482", "description": "Ona theme <=1.23.2 subscriber+ arbitrary file write/delete via ona_activate_child_theme missing capability check on slug parameter", "mode": "block", "severity": 9.9, "slug": "ona", "tags": ["arbitrary-file-upload", "path-traversal", "missing-authorization", "authenticated"], "target": "theme", "versions": "<=1.23.2"}, "RULE-CVE-2026-32482-02": {"ajax_action": "ona_update_child_theme", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)|\\\\.[Pp][Hh](?:[Pp]\\\\d?|[Ss]|[Tt](?:ml)?|[Aa][Rr]))~"}, {"type": "missing_capability", "value": "switch_themes"}], "cve": "CVE-2026-32482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32482", "description": "Ona theme <=1.23.2 subscriber+ arbitrary file write/delete via ona_update_child_theme missing capability check on slug parameter", "mode": "block", "severity": 9.9, "slug": "ona", "tags": ["arbitrary-file-upload", "path-traversal", "missing-authorization", "authenticated"], "target": "theme", "versions": "<=1.23.2"}, "RULE-CVE-2026-32484-03": {"ajax_action": "weforms_import_form", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:file_content", "type": "regex", "value": "~(?:O|C):\\\\d+:[^;]{0,256}[{\\"]~"}], "cve": "CVE-2026-32484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32484", "description": "weForms <=1.6.26 authenticated PHP object injection via form import in weforms_import_form AJAX handler", "mode": "block", "severity": 8.8, "slug": "weforms", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.6.26"}, "RULE-CVE-2026-32485-01": {"ajax_action": "wpuf_draft_post", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32485", "description": "WP User Frontend <=4.2.8 unauthenticated broken access control allows modifying arbitrary draft posts via wpuf_draft_post AJAX action with post_id parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-user-frontend", "tags": ["broken-access-control", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-32494-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|img|svg|details|math)[\\\\s/>])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via type parameter in admin notices", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32494-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:slider", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|img|svg|details|math)[\\\\s/>])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via slider parameter in admin actions page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32498-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32498", "description": "RegistrationMagic <=6.0.7.6 missing authorization on rm_options_default_payment_method AJAX handler allows authenticated users to modify payment settings", "mode": "block", "severity": 7.5, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.0.7.6"}, "RULE-CVE-2026-32499-01": {"action": "init", "conditions": [{"name": "ARGS:qc_bot_str_fields", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via qc_bot_str_fields on init hook", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32499-02": {"ajax_action": "wpbo_search_site", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via s parameter in wpbo_search_site AJAX handler", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32513-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2026-32513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32513", "description": "JS Archive List <=6.1.7 PHP Object Injection via serialized included/excluded widget settings", "mode": "block", "severity": 8.8, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-32517-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via s (search) parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:paged", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via paged parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "contact-manager-form"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via form-page parameters (id, name, description, etc.)", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via REQUEST_URI on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32520-01": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|shop_manager)~i"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member role parameter", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32520-02": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~wp_capabilities\\\\[~"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member wp_capabilities array injection", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32525-01": {"ajax_action": "jet_fb_ssr_validation_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[\\\\s\\"\',=:])(?:(?:system|exec|passthru|eval|assert|include|include_once|require|require_once)\\\\s*\\\\(|(?:shell_exec|popen|proc_open|pcntl_exec|create_function|call_user_func|call_user_func_array|unserialize|maybe_unserialize|file_get_contents|file_put_contents|fwrite|fopen|curl_exec|preg_replace_callback|array_map|array_filter|array_reduce|usort|uasort|uksort|array_walk|array_walk_recursive)(?:[\\\\s\\"\',;(]|$))~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation AJAX handler", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32525-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jet-form-builder/v1/validate-field(?:[/?]|$)~i"}, {"name": "ARGS:callable", "type": "regex", "value": "~^(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|assert|eval|create_function|call_user_func|call_user_func_array)$~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation REST endpoint", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32530-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/courses(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API course endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/quiz(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API quiz endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/migration(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API migration endpoint", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32532-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<embed[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-32532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32532", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via Save_Form_Data form submission fields", "mode": "block", "severity": 7.1, "slug": "lead-form-builder", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-32533-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php$~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:route_name", "type": "regex", "value": "~^(bookings|customers|agents|services|locations|transactions|coupons|settings|orders)(__|\\\\.)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32533", "description": "LatePoint <=5.2.6 IDOR via admin-post.php latepoint_route_call endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "latepoint", "tags": ["insecure-direct-object-reference", "missing-authorization"], "target": "plugin", "versions": "<=5.2.6"}, "RULE-CVE-2026-32537-01": {"ajax_action": "vp_dynamic_control_callback", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-32537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32537", "description": "Visual Portfolio <=3.5.1 authenticated local file inclusion via path traversal in vp_dynamic_control_callback AJAX handler", "mode": "block", "severity": 7.5, "slug": "visual-portfolio", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2026-32539-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q list table s parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:post_author", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q post_author parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:post_status", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q post_status parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q ids parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-archive"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-archive s parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-archive"}, {"name": "ARGS:origin_post_author", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-archive origin_post_author parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-07": {"ajax_action": "get-revision-diffs", "conditions": [{"name": "ARGS:post_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via get-revision-diffs AJAX post_ids parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32544-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/register/?(?:\\\\?|$)~"}, {"name": "ARGS:signup_username", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[^>]*onload\\\\s*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_username on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/register/?(?:\\\\?|$)~"}, {"name": "ARGS:signup_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[^>]*onload\\\\s*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_email on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg(?:[\\\\s>/]|/)[^>]*onload(?:\\\\s|/)*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz comment field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg(?:[\\\\s>/]|/)[^>]*onload(?:\\\\s|/)*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz author field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:email", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg(?:[\\\\s>/]|/)[^>]*onload(?:\\\\s|/)*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz email field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32545-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script(?![\\\\s]+src\\\\s*=\\\\s*[\'\\"]https://)[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+\\\\bonerror\\\\b|<svg[^>]+\\\\bonload\\\\b|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-32545", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32545", "description": "Taboola Pixel <=1.1.4 unauthenticated reflected XSS via front-end query parameters", "mode": "block", "severity": 7.1, "slug": "taboola-pixel", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-32546-01": {"action": "init", "conditions": [{"name": "ARGS:rcp_action", "type": "equals", "value": "toggle_auto_renew_off"}, {"name": "ARGS:membership_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-32546", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32546", "description": "Restrict Content <=3.2.22 unauthenticated membership auto-renew toggle via rcp_action parameter", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.2.22"}, "RULE-CVE-2026-32553-01": {"ajax_action": "handle_trigger_button_click", "conditions": [{"name": "ARGS:/st_login_url|st_non_login_url/", "type": "regex", "value": "~(?:(?:https?|ftp|gopher|dict|file|php|ldap)://)?(?:127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|localhost|169\\\\.254\\\\.169\\\\.254|100\\\\.100\\\\.100\\\\.200|metadata\\\\.google\\\\.internal|\\\\[::1\\\\]|fd00:ec2::254|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[0-1])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3})|^(?:gopher|dict|file|php|ldap)://~i"}], "cve": "CVE-2026-32553", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32553", "description": "OttoKit (SureTriggers) <=1.1.35 unauthenticated SSRF payload via handle_trigger_button_click AJAX st_login_url/st_non_login_url parameters", "mode": "block", "severity": 7.2, "slug": "suretriggers", "tags": ["ssrf", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.1.35"}, "RULE-CVE-2026-32573-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nab/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\?(?:php)?|\\\\b(?:eval|assert|system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec)\\\\s*\\\\(|\\\\b(?:include|require)(?:_once)?\\\\s*\\\\(|`[^`]+`)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32573", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32573", "description": "Nelio A/B Testing <=8.2.7 authenticated (Editor+) remote code execution via PHP snippet scope rules on non-PHP experiment types", "method": "POST", "mode": "block", "severity": 9.1, "slug": "nelio-ab-testing", "tags": ["remote-code-execution", "code-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-3296-01": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (AJAX path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3296-02": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[form_id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (non-AJAX init path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3297-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3297-02": {"ajax_action": "pagelayer_save_templ_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_templ_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3300-01": {"action": "wp", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:[`]|\\\\$\\\\{|\\\\bsystem\\\\s*\\\\(|\\\\bexec\\\\s*\\\\(|\\\\bpassthru\\\\s*\\\\(|\\\\bshell_exec\\\\s*\\\\(|\\\\bpopen\\\\s*\\\\(|\\\\bproc_open\\\\s*\\\\(|\\\\beval\\\\s*\\\\(|\\\\bbase64_decode\\\\s*\\\\(|\\\\bfile_(?:get|put)_contents\\\\s*\\\\(|\\\\bcurl_exec\\\\s*\\\\()~i"}], "cve": "CVE-2026-3300", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3300", "description": "Everest Forms <=1.9.9 unauthenticated RCE via Calculation Addon process_filter() eval injection through form field values", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-3311-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~tp[_-]progress[_-]bar.*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3311", "description": "The Plus Addons for Elementor <=6.4.9 contributor+ stored XSS via Progress Bar widget attributes", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.4.9"}, "RULE-CVE-2026-3328-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[redirect]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[redirect] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_url]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_url] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[update_message]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[update_message] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_fields_save]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_fields_save] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3334-01": {"action": "setup_theme", "conditions": [{"name": "ARGS:or_blogname", "type": "regex", "value": "~(?:[\'\\"][^&]{0,128}?(?:OR|AND)\\\\s+(?:[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\(?\\\\s*SELECT\\\\b)|UNION(?:/\\\\*\\\\*/|\\\\s)+(?:ALL(?:/\\\\*\\\\*/|\\\\s)+)?SELECT\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3334", "description": "CMS Commander <=2.288 SQL injection via or_blogname in restore workflow", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cms-commander-client", "tags": ["sql-injection", "custom-auth", "backup-restore"], "target": "plugin", "versions": "<=2.288"}, "RULE-CVE-2026-3334-02": {"action": "setup_theme", "conditions": [{"name": "ARGS:or_blogdescription", "type": "regex", "value": "~(?:[\'\\"][^&]{0,128}?(?:OR|AND)\\\\s+(?:[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\(?\\\\s*SELECT\\\\b)|UNION(?:/\\\\*\\\\*/|\\\\s)+(?:ALL(?:/\\\\*\\\\*/|\\\\s)+)?SELECT\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3334", "description": "CMS Commander <=2.288 SQL injection via or_blogdescription in restore workflow", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cms-commander-client", "tags": ["sql-injection", "custom-auth", "backup-restore"], "target": "plugin", "versions": "<=2.288"}, "RULE-CVE-2026-3334-03": {"action": "setup_theme", "conditions": [{"name": "ARGS:or_admin_email", "type": "regex", "value": "~(?:[\'\\"][^&]{0,128}?(?:OR|AND)\\\\s+(?:[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\(?\\\\s*SELECT\\\\b)|UNION(?:/\\\\*\\\\*/|\\\\s)+(?:ALL(?:/\\\\*\\\\*/|\\\\s)+)?SELECT\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3334", "description": "CMS Commander <=2.288 SQL injection via or_admin_email in restore workflow", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cms-commander-client", "tags": ["sql-injection", "custom-auth", "backup-restore"], "target": "plugin", "versions": "<=2.288"}, "RULE-CVE-2026-3352-01": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3352-02": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_max_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_max_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3353-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/options\\\\.php(?:$|\\\\?)~"}, {"name": "ARGS:option_page", "type": "equals", "value": "csw-settings-group"}, {"name": "ARGS:csw_api_key", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|style|link|body|input|details|video|audio|source|math|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle|animationstart|animationend|animationiteration)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/[a-z+.\\\\-]+\\\\s*;\\\\s*base64|[\\"\'][\\\\s/]*on[a-z]+\\\\s*=|[\\"\']\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2026-3353", "description": "Comment SPAM Wiper <=1.2.1 authenticated (admin) stored XSS via csw_api_key option saved through WordPress Settings API", "mode": "block", "severity": 4.4, "slug": "comment-spam-wiper", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-3354-01": {"action": "admin_post_wikilookup_settings_form_response", "conditions": [{"name": "ARGS:popup_width", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-3354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3354", "description": "WikiLookup <=1.1.5 stored XSS via Popup Width setting in admin panel", "mode": "block", "severity": 4.4, "slug": "wikilookup", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-3355-01": {"action": "init", "conditions": [{"name": "ARGS:crsearch", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe)[\\\\s/>])~i"}], "cve": "CVE-2026-3355", "description": "Customer Reviews for WooCommerce <=5.101.0 unauthenticated reflected XSS via crsearch query parameter", "mode": "block", "severity": 6.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<=5.101.0"}, "RULE-CVE-2026-3355-02": {"ajax_action": "cr_filter_reviews", "conditions": [{"name": "ARGS:crsearch", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe)[\\\\s/>])~i"}], "cve": "CVE-2026-3355", "description": "Customer Reviews for WooCommerce <=5.101.0 unauthenticated reflected XSS via crsearch in cr_filter_reviews AJAX handler", "mode": "block", "severity": 6.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<=5.101.0"}, "RULE-CVE-2026-3360-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:tutor_action", "type": "equals", "value": "pay_incomplete_order"}, {"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-3360", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3360", "description": "Tutor LMS <=3.9.7 unauthenticated IDOR billing profile overwrite via pay_incomplete_order", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "unauthenticated", "data-tampering"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-3427-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~<!--[\\\\s\\\\S]*?wp:yoast[\\\\s]+seo/how-to[\\\\s\\\\S]*?jsonText[\\\\s\\\\S]*?(?:<script|javascript[\\\\s]*:)|jsonText[^>]*<script[\\\\s/]*>|yoast-how-to[^\\\\\\"]*\\\\\\"jsonText\\\\\\":\\\\\\"[^\\\\\\"]*<script~i"}], "cve": "CVE-2026-3427", "description": "Yoast SEO <=27.1.1 stored XSS via HowTo schema jsonText block attribute", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "target": "plugin", "versions": "<=27.1.1"}, "RULE-CVE-2026-3454-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/generateblocks/v1/dynamic-tag-replacements(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\{\\\\{\\\\s*(?:post_meta|post_title|post_excerpt|post_content|post_date|post_author|post_status|author_email)\\\\s[^}]*\\\\bid\\\\s*:\\\\s*[0-9]~i"}], "cve": "CVE-2026-3454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3454", "description": "GenerateBlocks <=2.2.0 IDOR information disclosure via dynamic tag id parameter in REST endpoint", "mode": "block", "severity": 6.5, "slug": "generateblocks", "tags": ["idor", "information-disclosure", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2026-3456-01": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS:attributekey", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\s+WHEN\\\\b)~i"}], "cve": "CVE-2026-3456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3456", "description": "GeekyBot <=1.2.0 unauthenticated SQL injection via attributekey in geekybot_ajax", "mode": "block", "severity": 7.5, "slug": "geeky-bot", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-3456-02": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS:attributekey", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\s+WHEN\\\\b)~i"}], "cve": "CVE-2026-3456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3456", "description": "GeekyBot <=1.2.0 unauthenticated SQL injection via attributekey in geekybot_frontendajax", "mode": "block", "severity": 7.5, "slug": "geeky-bot", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-3459-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~[*]~"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file upload via wildcard supported_type parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-upload", "unauthenticated", "file-type-validation"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3459-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~(?:^|,|[|])\\\\s*\\\\.?(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx)\\\\s*(?:,|[|]|$)~i"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file upload via dangerous extensions in supported_type", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-upload", "unauthenticated", "file-type-validation"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3459-03": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|/etc/passwd|(?:^|[\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)$)~i"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file deletion via path traversal in delete handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3464-01": {"ajax_action": "cuar_attach_file", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:/|\\\\\\\\)etc(?:/|\\\\\\\\)passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-3464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3464", "description": "WP Customer Area <=8.3.4 authenticated arbitrary file read/deletion via path traversal in cuar_attach_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "customer-area", "tags": ["path-traversal", "arbitrary-file-read", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2026-3464-02": {"ajax_action": "cuar_remove_attached_file", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:/|\\\\\\\\)etc(?:/|\\\\\\\\)passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-3464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3464", "description": "WP Customer Area <=8.3.4 authenticated arbitrary file deletion via path traversal in cuar_remove_attached_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "customer-area", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2026-3488-01": {"ajax_action": "wp_statistics_getPrivacyStatus", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3488", "description": "WP Statistics <=14.16.4 missing authorization on getPrivacyStatus AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-3488-02": {"ajax_action": "wp_statistics_updatePrivacyStatus", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3488", "description": "WP Statistics <=14.16.4 missing authorization on updatePrivacyStatus AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-34885-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[s]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|--\\\\s*$|[\'\\")0-9]\\\\s*#[\\\\s\\\\S]*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[s] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34885-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[mla_search_value]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|[\'\\")0-9]\\\\s*(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[mla_search_value] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34885-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|,[\\\\s/\\\\*]*\\\\([\\\\s/\\\\*]*SELECT[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|[\'\\")0-9]\\\\s*(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34886-01": {"ajax_action": "swpm_process_pp_smart_checkout", "conditions": [{"name": "ARGS:button_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 unauthenticated broken access control on PayPal smart checkout AJAX handler", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-34886-02": {"ajax_action": "swpm_stripe_sca_create_checkout_session", "conditions": [{"name": "ARGS:button_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 unauthenticated broken access control on Stripe SCA checkout session AJAX handler", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-34886-03": {"ajax_action": "swpm_reset_log_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 missing authorization on log reset AJAX handler allows subscriber+ log deletion", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-3489-01": {"ajax_action": "directorypress_handler_request", "conditions": [{"name": "ARGS:packages", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-3489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3489", "description": "DirectoryPress <=3.6.26 unauthenticated SQL injection via packages parameter in handler_request AJAX handler", "mode": "block", "severity": 7.5, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.26"}, "RULE-CVE-2026-34896-01": {"action": "admin_init", "conditions": [{"name": "ARGS:ucmm-review-dismiss", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34896", "description": "Under Construction, Coming Soon & Maintenance Mode <=2.1.1 CSRF via ucmm-review-dismiss parameter on admin_init \\u2014 blocks non-admin exploitation only (CSRF against admin victims is not WAF-coverable without header inspection)", "mode": "block", "severity": 7.5, "slug": "under-construction-maintenance-mode", "tags": ["csrf", "cross-site-request-forgery", "state-change"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-34900-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|svg|body|img|input|form|details|marquee|isindex|meta)\\\\b[^>]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2026-34900", "description": "GiveWP <=4.14.2 unauthenticated reflected XSS via search parameter in donation_history shortcode", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.2"}, "RULE-CVE-2026-34902-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-34902", "description": "WooCommerce Product Table Lite <=4.6.3 unauthenticated reflected XSS via id parameter in wcpt_ajax", "mode": "block", "severity": 7.1, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-34902-02": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-34902", "description": "WooCommerce Product Table Lite <=4.6.3 unauthenticated reflected XSS via search parameter s in wcpt_ajax", "mode": "block", "severity": 7.1, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-34903-01": {"ajax_action": "oceanwp_cp_save_panel_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_panel_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-02": {"ajax_action": "oceanwp_cp_save_customizer_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_customizer_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-03": {"ajax_action": "oceanwp_cp_save_integrations_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_integrations_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-04": {"ajax_action": "oceanwp_cp_save_single_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_single_option AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-05": {"ajax_action": "oceanwp_cp_customizer_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_reset AJAX handler allows subscriber+ theme customizer settings reset", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-06": {"ajax_action": "oceanwp_cp_customizer_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_export AJAX handler allows subscriber+ theme customizer data export", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-07": {"ajax_action": "oceanwp_cp_customizer_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_import AJAX handler allows subscriber+ theme customizer data import via file parameter", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-08": {"ajax_action": "oceanwp_cp_child_theme_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_child_theme_install AJAX handler allows subscriber+ arbitrary file write via child theme install", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated", "file-write"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-09": {"ajax_action": "oceanwp_cp_system_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_system_status AJAX handler allows subscriber+ system information disclosure", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34904-01": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug set_option allows arbitrary options update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "options-update", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-34904-02": {"action": "admin_init", "conditions": [{"name": "ARGS:load_option_name", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug load_option allows arbitrary options read", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-34904-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wpb_clear_api_cache", "type": "equals", "value": "true"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug clear_cache allows unauthorized cache clearing", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-3498-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:blockart/(?:post-template|query-loop)[\\\\s\\\\S]{0,4000}?[\\"\\\\\\\\]clientId[\\"\\\\\\\\]\\\\s*:\\\\s*[\\"\\\\\\\\][^\\"\\\\\\\\]{0,2000}?(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|\\\\\\\\u003[cCeE]|&#x?(?:3[cCeE]|60|62);)~i"}], "cve": "CVE-2026-3498", "description": "BlockArt Blocks <=2.2.15 Author+ stored XSS via clientId attribute in blockart/post-template and blockart/query-loop blocks saved through WP core REST posts/pages endpoints", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "target": "plugin", "versions": "<=2.2.15"}, "RULE-CVE-2026-3498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:blockart/(?:post-template|query-loop)[\\\\s\\\\S]{0,4000}?[\\"\\\\\\\\]clientId[\\"\\\\\\\\]\\\\s*:\\\\s*[\\"\\\\\\\\][^\\"\\\\\\\\]{0,2000}?(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|\\\\\\\\u003[cCeE]|&#x?(?:3[cCeE]|60|62);)~i"}], "cve": "CVE-2026-3498", "description": "BlockArt Blocks <=2.2.15 Author+ stored XSS via clientId attribute submitted through classic editor admin-post path", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "target": "plugin", "versions": "<=2.2.15"}, "RULE-CVE-2026-3499-01": {"ajax_action": "adt_migrate_to_custom_post_type", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3499", "description": "Product Feed PRO for WooCommerce >=13.4.6 <=13.5.2.1 CSRF on adt_migrate_to_custom_post_type AJAX handler", "mode": "block", "severity": 8.8, "slug": "woo-product-feed-pro", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": ">=13.4.6 <=13.5.2.1"}, "RULE-CVE-2026-3499-02": {"ajax_action": "adt_clear_custom_attributes_product_meta_keys", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3499", "description": "Product Feed PRO for WooCommerce >=13.4.6 <=13.5.2.1 CSRF on adt_clear_custom_attributes_product_meta_keys AJAX handler", "mode": "block", "severity": 8.8, "slug": "woo-product-feed-pro", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": ">=13.4.6 <=13.5.2.1"}, "RULE-CVE-2026-3533-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "import_popup_action"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3533", "description": "JupiterX Core <=4.11.0 missing authorization on admin_action_import_popup_action allows low-privilege users to import arbitrary popup templates", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.11.0"}, "RULE-CVE-2026-3534-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~i"}, {"name": "ARGS:ast-page-background-meta[/.+/][/.+/]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</style|expression\\\\s*\\\\(|[\\"\']\\\\s*>)~i"}], "cve": "CVE-2026-3534", "description": "Astra theme <=4.12.3 stored XSS via ast-page-background-meta post meta field due to missing input sanitization and output escaping in astra_get_responsive_background_obj()", "mode": "block", "slug": "astra", "target": "theme", "versions": "<=4.12.3"}, "RULE-CVE-2026-3534-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~i"}, {"name": "ARGS:ast-content-background-meta[/.+/][/.+/]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</style|expression\\\\s*\\\\(|[\\"\']\\\\s*>)~i"}], "cve": "CVE-2026-3534", "description": "Astra theme <=4.12.3 stored XSS via ast-content-background-meta post meta field due to missing input sanitization and output escaping in astra_get_responsive_background_obj()", "mode": "block", "slug": "astra", "target": "theme", "versions": "<=4.12.3"}, "RULE-CVE-2026-3550-04": {"ajax_action": "rockpress_check_services", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3550", "description": "FT RockPress <=1.0.17 missing authorization on rockpress_check_services AJAX handler allows subscriber+ to perform system connection checks", "mode": "block", "severity": 5.3, "slug": "ft-rockpress", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.17"}, "RULE-CVE-2026-3571-01": {"action": "init", "conditions": [{"name": "ARGS:prfrmid", "type": "exists"}, {"name": "ARGS:status", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3571", "description": "Pie Register <=3.8.4.8 unauthenticated registration form status modification via pie_main()", "mode": "block", "severity": 6.5, "slug": "pie-register", "tags": ["missing-authorization", "unauthenticated", "parameter-tampering"], "target": "plugin", "versions": "<=3.8.4.8"}, "RULE-CVE-2026-3577-01": {"ajax_action": "update_kbd_bkup_alias", "conditions": [{"name": "ARGS:val", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|embed|object)[\\\\s/>])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3577", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3577", "description": "Keep Backup Daily <=2.1.2 authenticated stored XSS via val parameter in update_kbd_bkup_alias AJAX handler", "mode": "block", "severity": 4.4, "slug": "keep-backup-daily", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2026-3584-01": {"ajax_action": "kaliforms_form_process", "conditions": [{"name": "ARGS:data[{entryCounter}]", "type": "regex", "value": "~^\\\\\\\\?(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|create_function|call_user_func|call_user_func_array|phpinfo|file_put_contents|file_get_contents|unlink|rmdir|mail|header|preg_replace)$~i"}], "cve": "CVE-2026-3584", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3584", "description": "Kali Forms <=2.4.9 unauthenticated RCE via placeholder overwrite in kaliforms_form_process using {entryCounter}", "method": "POST", "mode": "block", "severity": 9.8, "slug": "kali-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "callable-injection"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-3585-01": {"ajax_action": "tribe_aggregator_create_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|file\\\\s*://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3585", "description": "The Events Calendar <=6.15.17 authenticated (Author+) arbitrary file read via path traversal in tribe_aggregator_create_import AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.15.17"}, "RULE-CVE-2026-3585-02": {"ajax_action": "tribe_aggregator_create_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[^a-zA-Z0-9])|debug\\\\.log|(?:^|[\\\\\\\\/])error_log(?:$|[^a-zA-Z0-9]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3585", "description": "The Events Calendar <=6.15.17 authenticated (Author+) arbitrary file read via sensitive file path in tribe_aggregator_create_import AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.15.17"}, "RULE-CVE-2026-3589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc/store/v1/batch([/?&]|$)~i"}, {"name": "ARGS:requests[/\\\\d+/][path]", "type": "regex", "value": "~^/(?!wc/store[/?])~i"}], "cve": "CVE-2026-3589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3589", "description": "WooCommerce >=5.4.0 <=10.5.2 CSRF via Store API batch endpoint routing sub-requests to arbitrary non-Store REST endpoints. Covers both form-urlencoded and JSON body (application/json) POST variants via transparent JSON body parsing.", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woocommerce", "tags": ["csrf", "broken-access-control", "rest-api", "batch-route-hijack"], "target": "plugin", "versions": ">=5.4.0 <=10.5.2"}, "RULE-CVE-2026-3614-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:ctrl", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3614", "description": "AcyMailing 9.11.0-10.8.1 privilege escalation via acymailing_router AJAX to admin controller dispatch", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "ajax"], "target": "plugin", "versions": ">=9.11.0 <=10.8.1"}, "RULE-CVE-2026-3629-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 unauthenticated privilege escalation via wp_capabilities parameter during registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 authenticated privilege escalation via wp_capabilities parameter during profile update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp_capabilities[administrator]", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 privilege escalation via wp_capabilities bracket notation during registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:wp_capabilities[administrator]", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 privilege escalation via wp_capabilities bracket notation during profile update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3643-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/otm-ac/v1/update-widget-options(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3643", "description": "Accessibly <=3.0.3 unauthenticated stored XSS via REST API update-widget-options endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "otm-accessibly", "tags": ["xss", "stored", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.0.3"}, "RULE-CVE-2026-3655-01": {"ajax_action": "lwp_ajax_register", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "lwp_ajax_register"}, {"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:idToken", "type": "regex", "value": "/^eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.[A-Za-z0-9_\\\\-]{10,}$/"}], "cve": "CVE-2026-3655", "description": "Login With Phone Number >=1.8.50 <=1.8.60 unauthenticated authentication bypass via lwp_ajax_register Firebase phone binding flaw", "mode": "block", "severity": 9.8, "slug": "login-with-phone-number", "target": "plugin", "versions": ">=1.8.50 <=1.8.60"}, "RULE-CVE-2026-3655-02": {"ajax_action": "lwp_ajax_login", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "lwp_ajax_login"}, {"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:idToken", "type": "regex", "value": "/^eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.[A-Za-z0-9_\\\\-]{10,}$/"}], "cve": "CVE-2026-3655", "description": "Login With Phone Number >=1.8.50 <=1.8.60 unauthenticated authentication bypass via lwp_ajax_login Firebase phone binding flaw", "mode": "block", "severity": 9.8, "slug": "login-with-phone-number", "target": "plugin", "versions": ">=1.8.50 <=1.8.60"}, "RULE-CVE-2026-3657-01": {"ajax_action": "stickymenu_contact_lead_form", "conditions": [{"name": "ARGS:save_form_lead", "type": "exists"}, {"name": "ARGS:/.*(?:`|\'|\\"|[(]|;|--).*/", "type": "exists"}], "cve": "CVE-2026-3657", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3657", "description": "myStickymenu <=2.8.6 unauthenticated SQL injection via crafted POST parameter names in stickymenu_contact_lead_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "mystickymenu", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2026-3658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via orderby parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via order parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via search parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:filter", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via filter parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3718-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:MWP-Key-Name", "type": "regex", "value": "~(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:|svg\\\\s*onload|body\\\\s*onload)~i"}], "cve": "CVE-2026-3718", "description": "Worker <=4.9.31 stored XSS via MWP-Key-Name HTTP header", "mode": "block", "severity": 7.2, "slug": "worker", "target": "plugin", "versions": "<=4.9.31"}, "RULE-CVE-2026-3722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_wp_attachment_image_alt", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via _wp_attachment_image_alt on attachment edit", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3722-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via post_title on attachment edit", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3722-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "ARGS:alt_text", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via REST API alt_text on media update", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3772-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/plugins\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^wpeditor_plugin$~i"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:^|/)(?:wp-content/plugins/[^?&#]+\\\\.php|[^/]+\\\\.php)$~i"}, {"name": "ARGS:new-content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|base64_decode|assert)\\\\s*\\\\()~i"}], "cve": "CVE-2026-3772", "description": "WP Editor <=1.2.9.2 CSRF in add_plugins_page allows unauthenticated attackers to overwrite plugin PHP files via forged request", "mode": "block", "severity": 8.8, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9.2"}, "RULE-CVE-2026-3772-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/themes\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^wpeditor_themes$~i"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:^|/)(?:wp-content/themes/[^?&#]+\\\\.php|[^/]+\\\\.php)$~i"}, {"name": "ARGS:new-content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|base64_decode|assert)\\\\s*\\\\()~i"}], "cve": "CVE-2026-3772", "description": "WP Editor <=1.2.9.2 CSRF in add_themes_page allows unauthenticated attackers to overwrite theme PHP files via forged request", "mode": "block", "severity": 8.8, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9.2"}, "RULE-CVE-2026-3844-01": {"ajax_action": "save_settings_tab_basic", "conditions": [{"name": "ARGS:breeze-store-gravatars-locally", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block enabling \'Host Files Locally Gravatars\' setting (defense in depth; prevents activating the vulnerable code path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "configuration-block"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3844-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:wp-comments-post\\\\.php(?:\\\\?|$)|(?:index\\\\.php\\\\?rest_route=/)?wp(?:-json)?/wp/v2/comments(?:/|\\\\?|$))~"}, {"name": "ARGS:/^(?:author|email|url|author_name|author_email|author_url|comment_author(?:_email|_url)?)$/", "type": "regex", "value": "~\\\\bsrc(?:set)?\\\\s*=\\\\s*[\\"\']?\\\\s*https?://[^\\\\s\\"\'<>]{1,500}\\\\.(?:php[3-8s]?|phtml|phar|pht|inc|phps|jsp|aspx?|cgi|pl|py|rb|sh|exe|htaccess)(?:[?#/\\\\s\\"\'&]|$)~i"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block comment submission carrying src/srcset payload pointing to executable extension (Stage 1; attacker seeds malicious gravatar URL via author fields, which Breeze\'s loose regex extracts and fetches)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "server-side-fetch"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3844-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:wp-comments-post\\\\.php(?:\\\\?|$)|(?:index\\\\.php\\\\?rest_route=/)?wp(?:-json)?/wp/v2/comments(?:/|\\\\?|$))~"}, {"name": "ARGS:srcset", "type": "regex", "value": "~^\\\\s*https?://~i"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block a structurally-suspicious standalone POST\\nfield carrying an http(s):// URL on comment-submission endpoints. Native\\nWordPress comment forms do not POST this field, so its presence with a\\nURL value is consistent only with attacker-driven URL injection aimed at\\ncircumventing RULE-02\'s named-field allowlist. The plugin\'s URL extractor\\nscans the entire POST array, so this rule covers fields outside RULE-02\'s\\nsource set.\\n", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "server-side-fetch", "bypass-fix"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3875-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[betterdocs_feedback_form\\\\s[^\\\\]]*(?:on(?:error|load|mouseover|click|focus|blur)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|\\\\\\"\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3875", "description": "BetterDocs <=4.3.8 contributor+ stored XSS via betterdocs_feedback_form shortcode attributes", "mode": "block", "slug": "betterdocs", "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2026-3876-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[prismatic_encoded\\\\b[^\\\\]]*(?:on(?:mouse(?:over|out|down|up|move|enter|leave)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select|abort|unload|resize|scroll|beforeunload|hashchange|pointerover|pointerenter|animationend|transitionend)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}], "cve": "CVE-2026-3876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3876", "description": "Prismatic <=3.7.3 unauthenticated stored XSS via prismatic_encoded pseudo-shortcode in comment body", "method": "POST", "mode": "block", "severity": 7.2, "slug": "prismatic", "tags": ["xss", "stored", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39432-01": {"ajax_action": "dismiss_woocommerce_notice", "conditions": [{"name": "ARGS:notice_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39432", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39432", "description": "Timetics <=1.0.53 broken access control on dismiss_woocommerce_notice allows subscriber+ users to dismiss admin notices", "method": "POST", "mode": "block", "severity": 8.2, "slug": "timetics", "tags": ["broken-access-control", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.53"}, "RULE-CVE-2026-39432-02": {"ajax_action": "wpmet-notices", "conditions": [{"name": "ARGS:notice_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39432", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39432", "description": "Timetics <=1.0.53 broken access control on wpmet-notices allows authenticated users to dismiss plugin notices", "method": "POST", "mode": "block", "severity": 8.2, "slug": "timetics", "tags": ["broken-access-control", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.53"}, "RULE-CVE-2026-39437-01": {"ajax_action": "alg_wc_pq_update_price_by_qty", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_price_by_qty AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39437-02": {"ajax_action": "alg_wc_pq_update_get_dropdown_options", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_get_dropdown_options AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39437-03": {"ajax_action": "alg_wc_pq_update_get_input_options", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_get_input_options AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:feed[=/]kuantokusta(?:[/?]|$)|[?&]feed=kuantokusta(?:&|$))~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:%20|\\\\+|%2520)(?:UNION|SELECT|FROM|WHERE|INSERT|UPDATE|DELETE|DROP|ALTER)(?:%20|\\\\+|%2520)|UNION%20SELECT|UNION\\\\+SELECT|--|%2D%2D|%252D%252D|information_schema|wp_users|0x[0-9a-fA-F]+)~i"}], "cve": "CVE-2026-39441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39441", "description": "Feed KuantoKusta for WooCommerce <=5.3 unauthenticated SQL injection via public kuantokusta product feed endpoint", "mode": "block", "severity": 9.3, "slug": "feed-kuantokusta-for-woocommerce", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=5.3"}, "RULE-CVE-2026-39450-01": {"ajax_action": "bwfan_update_automation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_update_automation AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39450-02": {"ajax_action": "bwfan_toggle_automation_state", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_toggle_automation_state AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39450-03": {"ajax_action": "bwfan_automation_submit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_automation_submit AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39464-01": {"ajax_action": "seedprod_lite_v2_import_theme_request", "conditions": [{"name": "ARGS:theme_url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.)|^https?://(?:0\\\\.)|^https?://(?:10\\\\.)|^https?://(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|^https?://(?:192\\\\.168\\\\.)|^https?://(?:169\\\\.254\\\\.)|^https?://localhost\\\\b|^https?://\\\\[::1\\\\]|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2026-39464", "description": "SeedProd Coming Soon <=6.19.8 authenticated SSRF via theme_url in seedprod_lite_v2_import_theme_request", "mode": "block", "severity": 5.5, "slug": "coming-soon", "target": "plugin", "versions": "<=6.19.8"}, "RULE-CVE-2026-39464-02": {"ajax_action": "seedprod_lite_v2_import_theme_by_url", "conditions": [{"name": "ARGS:theme_url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.)|^https?://(?:0\\\\.)|^https?://(?:10\\\\.)|^https?://(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|^https?://(?:192\\\\.168\\\\.)|^https?://(?:169\\\\.254\\\\.)|^https?://localhost\\\\b|^https?://\\\\[::1\\\\]|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2026-39464", "description": "SeedProd Coming Soon <=6.19.8 authenticated SSRF via theme_url in seedprod_lite_v2_import_theme_by_url", "mode": "block", "severity": 5.5, "slug": "coming-soon", "target": "plugin", "versions": "<=6.19.8"}, "RULE-CVE-2026-39466-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blc_local"}, {"name": "ARGS:filter_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via filter_id parameter on links page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39466-02": {"ajax_action": "blc_link_details", "conditions": [{"name": "ARGS:link_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via link_id in blc_link_details AJAX handler", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39466-03": {"ajax_action": "blc_discard", "conditions": [{"name": "ARGS:link_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via link_id in blc_discard AJAX handler", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39467-01": {"ajax_action": "ms_import_slideshows", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-39467", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39467", "description": "MetaSlider (ml-slider) <3.107.0 PHP Object Injection via ms_import_slideshows AJAX slideshow import", "mode": "block", "severity": 7.2, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<3.107.0"}, "RULE-CVE-2026-39467-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/metaslider/v1/slideshow/import[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-39467", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39467", "description": "MetaSlider (ml-slider) <3.107.0 PHP Object Injection via REST /metaslider/v1/slideshow/import", "mode": "block", "severity": 7.2, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.107.0"}, "RULE-CVE-2026-39467-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/metaslider/v1/slideshow/import[\\\\\\\\/]*$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-39467", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39467", "description": "MetaSlider (ml-slider) <3.107.0 PHP Object Injection via REST /metaslider/v1/slideshow/import", "mode": "block", "severity": 7.2, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.107.0"}, "RULE-CVE-2026-39468-01": {"ajax_action": "rwmb_delete_file", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39468", "description": "Meta Box <=5.11.1 contributor+ arbitrary file deletion via rwmb_delete_file AJAX handler (missing authorization + path traversal)", "mode": "block", "severity": 6.8, "slug": "meta-box", "target": "plugin", "versions": "<=5.11.1"}, "RULE-CVE-2026-39470-01": {"ajax_action": "cart_abandonment_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39470", "description": "Block unauthenticated/low-privilege plugin installation via cart_abandonment_install_plugin AJAX handler (CWE-266 Privilege Escalation)", "mode": "block", "severity": 7.2, "slug": "woo-cart-abandonment-recovery", "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2026-39470-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "wcar_rollback"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39470", "description": "Block unauthenticated/low-privilege rollback via admin_post_wcar_rollback (CWE-266 Privilege Escalation)", "mode": "block", "severity": 7.2, "slug": "woo-cart-abandonment-recovery", "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2026-39472-01": {"ajax_action": "wpo_wcpdf_save_document", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39472", "description": "WooCommerce PDF Invoices & Packing Slips <5.9.0 authenticated PHP Object Injection via wpo_wcpdf_save_document", "mode": "block", "severity": 7.2, "slug": "woocommerce-pdf-invoices-packing-slips", "target": "plugin", "versions": "<5.9.0"}, "RULE-CVE-2026-39472-02": {"ajax_action": "wpo_wcpdf_regenerate_document", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39472", "description": "WooCommerce PDF Invoices & Packing Slips <5.9.0 authenticated PHP Object Injection via wpo_wcpdf_regenerate_document", "mode": "block", "severity": 7.2, "slug": "woocommerce-pdf-invoices-packing-slips", "target": "plugin", "versions": "<5.9.0"}, "RULE-CVE-2026-39472-03": {"ajax_action": "wpo_wcpdf_delete_document", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39472", "description": "WooCommerce PDF Invoices & Packing Slips <5.9.0 authenticated PHP Object Injection via wpo_wcpdf_delete_document", "mode": "block", "severity": 7.2, "slug": "woocommerce-pdf-invoices-packing-slips", "target": "plugin", "versions": "<5.9.0"}, "RULE-CVE-2026-39474-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-duplicator/v1/duplicate-post(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39474", "description": "Post Duplicator <=3.0.10 missing authorization on duplicate-post REST endpoint allows contributor+ PHP object injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-duplicator", "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2026-39474-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-duplicator/v1/parent-posts(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39474", "description": "Post Duplicator <=3.0.10 missing authorization on parent-posts REST endpoint allows unauthorized data access", "mode": "block", "severity": 8.8, "slug": "post-duplicator", "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2026-39474-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-duplicator/v1/post-data/[0-9]+(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39474", "description": "Post Duplicator <=3.0.10 missing authorization on post-data REST endpoint allows unauthorized data access", "mode": "block", "severity": 8.8, "slug": "post-duplicator", "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2026-39474-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-duplicator/v1/post-full-data/[0-9]+(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39474", "description": "Post Duplicator <=3.0.10 missing authorization on post-full-data REST endpoint allows unauthorized data access", "mode": "block", "severity": 8.8, "slug": "post-duplicator", "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2026-39474-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-duplicator/v1/users(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39474", "description": "Post Duplicator <=3.0.10 missing authorization on users REST endpoint allows unauthorized user enumeration", "mode": "block", "severity": 8.8, "slug": "post-duplicator", "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2026-39475-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via orderby parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via order parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|\'\\\\s*(?:OR|AND)\\\\s+\\\\(?SELECT\\\\b)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via search parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39478-01": {"ajax_action": "GOTMLS_scan", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39478", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.87 unauthenticated/contributor PHP Object Injection via GOTMLS_scan AJAX handler", "mode": "block", "severity": 8.8, "slug": "gotmls", "target": "plugin", "versions": "<=4.23.87"}, "RULE-CVE-2026-39478-02": {"ajax_action": "GOTMLS_fix", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39478", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.87 unauthenticated/contributor PHP Object Injection via GOTMLS_fix AJAX handler", "mode": "block", "severity": 8.8, "slug": "gotmls", "target": "plugin", "versions": "<=4.23.87"}, "RULE-CVE-2026-39479-01": {"action": "admin_init", "conditions": [{"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via status_filter parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-02": {"action": "admin_init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via orderby parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-03": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b|[^A-Z](?:ASC|DESC)[^A-Z].*(?:ASC|DESC|SELECT|SLEEP|BENCHMARK))~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via order parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39480-01": {"ajax_action": "bmip_auth_handshake", "conditions": [{"name": "ARGS:challenge", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39480", "description": "Backup Migration <=2.1.1 unauthenticated sensitive data exposure via bmip_auth_handshake AJAX endpoint", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-39481-01": {"ajax_action": "modula_add_images_ids", "conditions": [{"name": "ARGS:modula_images", "type": "exists"}, {"name": "ARGS:modula_images", "type": "regex", "value": "~(?:O:\\\\d+:\\"|s:\\\\d+:\\\\\\\\?\\"|a:\\\\d+:\\\\{|C:\\\\d+:\\"|r:\\\\d+;)~"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39481", "description": "Block PHP Object Injection via modula_images parameter in Modula Image Gallery AJAX import handler for users lacking upload_files capability", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.14.18"}, "RULE-CVE-2026-39486-01": {"ajax_action": "dlm_db_log_entries", "conditions": [{"name": "ARGS:dlm_log_orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_db_log_entries AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-02": {"ajax_action": "dlm_alter_download_log", "conditions": [{"name": "ARGS:dlm_upgrade_db", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_alter_download_log AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-03": {"ajax_action": "download_monitor_list_files", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via download_monitor_list_files orderby parameter", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39491-01": {"ajax_action": "jupiterx_custom_snippets", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_custom_snippets AJAX handler (title/content/snippet_code)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-02": {"ajax_action": "jupiterx_layout_builder", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_layout_builder AJAX handler (title/layout_data/conditions)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-03": {"ajax_action": "raven_form_frontend", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 stored XSS via raven_form_frontend AJAX handler (fields) - also nopriv", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39492-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:route_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39492", "description": "WP Maps <=4.9.1 unauthenticated SQL injection via route_id in wpgmp_ajax_call AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-39493-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|CONCAT\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39493", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated SQL injection via ssa/v1 REST API", "mode": "block", "severity": 9.3, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39495", "description": "Simply Schedule Appointments <=1.6.9.27 authenticated (Contributor+) SQL injection via REST API", "mode": "block", "severity": 8.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39496-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail/~"}, {"name": "ARGS:email_type", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via email_type parameter in REST API get_templates endpoint", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39496-02": {"ajax_action": "yaymail_preview_mail_for_woo", "conditions": [{"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via yaymail_preview_mail_for_woo AJAX handler", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39496-03": {"ajax_action": "yaymail_preview_mail", "conditions": [{"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via yaymail_preview_mail AJAX handler", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39496-04": {"ajax_action": "yaymail_get_template_data_onload", "conditions": [{"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39496", "description": "YayMail <=4.3.3 authenticated (Shop Manager+) blind SQL injection via yaymail_get_template_data_onload AJAX handler", "mode": "block", "severity": 7.6, "slug": "yaymail", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39497-01": {"ajax_action": "woocs_recalculate_order_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_order_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-02": {"ajax_action": "woocs_recalculate_orders_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_orders_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-03": {"ajax_action": "woocs_update_order_rate", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_update_order_rate AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-04": {"ajax_action": "woocs_all_order_ids", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_all_order_ids AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-05": {"ajax_action": "woocs_stat_redraw", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_stat_redraw AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39498-01": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_templates AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import templates endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39498-02": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_state AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import state endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39499-01": {"ajax_action": "wapf_search_products", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39499", "description": "Advanced Product Fields for WooCommerce <=1.6.19 authenticated (Shop Manager+) PHP Object Injection via q parameter in wapf_search_products AJAX handler", "mode": "block", "severity": 7.2, "slug": "advanced-product-fields-for-woocommerce", "target": "plugin", "versions": "<=1.6.19"}, "RULE-CVE-2026-39511-01": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-album", "type": "regex", "value": "~[^0-9\\\\-]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-album parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-02": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-page", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-page parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-03": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-tag", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-tag parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-04": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-search parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39531-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_ne", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_ne parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_sw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_sw parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-03": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via dynamic search field parameters", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39533-01": {"ajax_action": "awpcp_create_empty_listing", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing creation via awpcp_create_empty_listing AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-02": {"ajax_action": "awpcp_save_listing_information", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing modification via awpcp_save_listing_information AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-03": {"ajax_action": "awpcp_update_listing_order", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing order update via awpcp_update_listing_order AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-04": {"ajax_action": "awpcp_update_submit_listing_sections", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing section update via awpcp_update_submit_listing_sections AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39579-01": {"ajax_action": "bblocks_api_keys", "conditions": [{"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39579", "description": "B Blocks <=2.0.31 contributor+ privilege escalation via bblocks_api_keys AJAX handler missing capability check", "mode": "block", "severity": 8.8, "slug": "b-blocks", "target": "plugin", "versions": "<=2.0.31"}, "RULE-CVE-2026-39581-01": {"ajax_action": "activitytime_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-02": {"ajax_action": "activitytime_mvc_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_mvc_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitytime/v1/action(?:/|\\\\?|$)~"}, {"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in REST API activitytime/v1/action endpoint", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39587-01": {"ajax_action": "app_ajax_register", "conditions": [{"name": "ARGS:role", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2026-39587", "description": "Block unauthenticated privilege escalation via app_ajax_register AJAX action in WP BASE Booking plugin <= 5.9.0. Attacker can register a user with an arbitrary role (e.g., administrator) through the unprotected registration handler.", "mode": "block", "severity": 8.1, "slug": "wp-base-booking-of-appointments-services-and-events", "target": "plugin", "versions": "<=5.9.0"}, "RULE-CVE-2026-39589-01": {"ajax_action": "action_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin installation via action_install_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-02": {"ajax_action": "activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin activation via activate_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-03": {"ajax_action": "extras_plugin_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin installation via extras_plugin_install AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-04": {"ajax_action": "extras_plugin_activate", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin activation via extras_plugin_activate AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-05": {"ajax_action": "extras_plugin_update", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary plugin update via extras_plugin_update AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-06": {"ajax_action": "extras_theme_install", "conditions": [{"type": "missing_capability", "value": "install_themes"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary theme installation via extras_theme_install AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-07": {"ajax_action": "extras_theme_activate", "conditions": [{"type": "missing_capability", "value": "switch_themes"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary theme activation via extras_theme_activate AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39589-08": {"ajax_action": "extras_theme_update", "conditions": [{"type": "missing_capability", "value": "update_themes"}], "cve": "CVE-2026-39589", "description": "Webenvo <=0.0.6 subscriber+ arbitrary theme update via extras_theme_update AJAX handler", "mode": "block", "severity": 9.9, "slug": "webenvo", "target": "theme", "versions": "<=0.0.6"}, "RULE-CVE-2026-39591-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via upload.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/uploadFile\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via uploadFile.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload(?:File)?\\\\.php~i"}, {"name": "ARGS:_target", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|[\\\\/]etc[\\\\/]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ path traversal via _target parameter in upload helpers", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39597-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 unauthenticated reflected XSS via posts_data JSON blob in wpz_posts_grid_load_more AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-02": {"ajax_action": "get_content_from_elementor_export_file", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:<script[\\\\s/>]|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via filename parameter (javascript protocol bypass) in get_content_from_elementor_export_file AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-03": {"ajax_action": "get_wpzoom_preview", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|style\\\\s*=)|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via url parameter attribute breakout in get_wpzoom_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39619-01": {"ajax_action": "busiprof_install_activate_plugin", "conditions": [{"name": "ARGS:plugin_url", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39619", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39619", "description": "Busiprof <=2.5.2 CSRF to arbitrary plugin install/web shell upload via busiprof_install_activate_plugin AJAX handler", "mode": "block", "severity": 9.6, "slug": "busiprof", "tags": ["csrf", "arbitrary-file-upload", "web-shell", "missing-authorization"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2026-39621-01": {"ajax_action": "spicepress_install_activate_plugin", "conditions": [{"name": "ARGS:plugin_url", "type": "regex", "value": "~^(?!https?://downloads\\\\.wordpress\\\\.org/)~i"}], "cve": "CVE-2026-39621", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39621", "description": "SpicePress <=2.3.2.5 CSRF to arbitrary plugin installation via spicepress_install_activate_plugin AJAX handler (missing nonce verification)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "spicepress", "tags": ["csrf", "arbitrary-plugin-installation", "remote-code-execution", "web-shell-upload"], "target": "theme", "versions": "<=2.3.2.5"}, "RULE-CVE-2026-39656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_direct_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_direct_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_reverse_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_reverse_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_settlement_change"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_settlement_change", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_payment_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_payment_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39665-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php\\\\?page=sfi_settings~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39665", "description": "SEO Image <=3.0.5 reflected XSS via REQUEST_URI in admin settings page", "mode": "block", "severity": 6.5, "slug": "seo-image", "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-39679-01": {"action": "init", "conditions": [{"name": "ARGS:/style|load_type/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-39679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39679", "description": "Freeio Theme <=1.3.21 local file inclusion via style/load_type parameters in template loading", "method": "GET", "mode": "block", "severity": 7.5, "slug": "freeio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3.21"}, "RULE-CVE-2026-3985-01": {"ajax_action": "ce4wp_abandoned_checkouts_capture_guest_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3985-02": {"ajax_action": "ce4wp_abandoned_checkouts_no_consent_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3986-01": {"action": "admin_init", "conditions": [{"name": "ARGS:form_structure", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3986", "description": "Calculated Fields Form <=5.4.5.0 authenticated (Contributor+) stored XSS via form_structure parameter containing unsanitized fcontent in fhtml field types", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calculated-fields-form", "tags": ["xss", "stored", "authenticated", "insufficient-sanitization"], "target": "plugin", "versions": "<=5.4.5.0"}, "RULE-CVE-2026-4021-01": {"ajax_action": "post_cg1l_login_user_by_key", "conditions": [{"name": "ARGS:cglKey", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4021", "description": "Contest Gallery <=28.1.5 unauthenticated account takeover via post_cg1l_login_user_by_key AJAX action (key-based login after type-confusion activation key overwrite)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=28.1.5"}, "RULE-CVE-2026-4024-01": {"ajax_action": "wpr_update_form_action_meta", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4024", "description": "Royal Elementor Addons <= 1.7.1056 - Unauthenticated Missing Authorization via wpr_update_form_action_meta (post-meta write with publicly-exposed nonce)", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-4029-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-db-backup"}, {"name": "ARGS:action", "type": "equals", "value": "backup"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2026-4029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4029", "description": "WP-DB-Backup <=2.5.2 unauthenticated backup export via admin menu in Multisite", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-01": {"ajax_action": "save_backup_time", "conditions": [{"name": "ARGS:location", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows arbitrary file deletion via location parameter path traversal", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-02": {"action": "init", "conditions": [{"name": "ARGS:via", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on init hook allows arbitrary file read via via parameter path traversal in Multisite", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4031-02": {"ajax_action": "save_backup_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:backup-time", "type": "exists"}], "cve": "CVE-2026-4031", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows subscriber+ schedule manipulation", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4056-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/user-registration/v1/content-access-rules(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4056", "description": "User Registration & Membership <=5.1.4 missing authorization on Content Access Rules REST API allows Contributor+ to create/read/update/delete/toggle/duplicate content restriction rules", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-4059-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[woolentor_quickview_button[^\\\\]]*button_text\\\\s*=\\\\s*(?:\\"|&quot;|&#34;|\')[^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4059", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4059", "description": "ShopLentor <=3.3.5 Contributor+ stored XSS via woolentor_quickview_button shortcode button_text attribute", "mode": "block", "severity": 6.4, "slug": "woolentor-addons", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2026-4060-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via sort parameter in AJAX query", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4060-02": {"action": "init", "conditions": [{"name": "ARGS:gm_sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via gm_sort front-end parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4061-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:map_post_type", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-4061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4061", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via map_post_type parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:exclude_object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via exclude_object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids query var in template_redirect handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4066-01": {"ajax_action": "smart-cf-relational-posts-search", "conditions": [{"name": "ARGS:post_types", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-4066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4066", "description": "Smart Custom Fields <=5.0.6 missing per-post authorization in relational posts search allows authenticated users with read capability to enumerate private and draft posts", "mode": "block", "severity": 4.3, "slug": "smart-custom-fields", "tags": ["missing-authorization", "information-disclosure", "ajax"], "target": "plugin", "versions": "<=5.0.6"}, "RULE-CVE-2026-40727-01": {"ajax_action": "bulk_action_listener", "conditions": [{"name": "ARGS:action", "type": "exists"}, {"name": "ARGS:imported", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40727", "description": "Groundhogg <= 4.4 \\u2014 Missing Authorization on Imported File Deletion via bulk_action_listener AJAX (CWE-862)", "mode": "block", "severity": 7.7, "slug": "groundhogg", "target": "plugin", "versions": "<4.4.1"}, "RULE-CVE-2026-40744-01": {"ajax_action": "fl_builder_export_templates_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40744", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40744", "description": "Beaver Builder <=2.10.1.2 authenticated SQL injection via fl_builder_export_templates_data AJAX handler", "mode": "block", "severity": 8.5, "slug": "beaver-builder-lite-version", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=2.10.1.2"}, "RULE-CVE-2026-40745-01": {"ajax_action": "elementpack_dynamic_select_input_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"\']?\\\\d)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-40745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40745", "description": "Element Pack Elementor Addons <=8.4.2 authenticated blind SQL injection via elementpack_dynamic_select_input_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "bdthemes-element-pack-lite", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-40749-01": {"ajax_action": "import_theme_mods", "conditions": [{"name": "FILES:import_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|(?:^|\\\\\\\\.)user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40749", "description": "Charity Zone <=1.1.1 subscriber+ arbitrary file upload via import_theme_mods AJAX handler \\u2014 blocks dangerous file extensions", "mode": "block", "severity": 9.9, "slug": "charity-zone", "target": "theme", "versions": "<=1.1.1"}, "RULE-CVE-2026-40749-02": {"ajax_action": "charity_zone_install_and_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-40749", "description": "Charity Zone <=1.1.1 subscriber+ unauthorized plugin installation via charity_zone_install_and_activate_plugin", "mode": "block", "severity": 9.9, "slug": "charity-zone", "target": "theme", "versions": "<=1.1.1"}, "RULE-CVE-2026-40749-03": {"ajax_action": "tm_install_and_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-40749", "description": "Charity Zone <=1.1.1 subscriber+ unauthorized plugin installation via tm_install_and_activate_plugin", "mode": "block", "severity": 9.9, "slug": "charity-zone", "target": "theme", "versions": "<=1.1.1"}, "RULE-CVE-2026-4075-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-4075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-40764-01": {"ajax_action": "wpforms_admin_forms_overview_save_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on save_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-02": {"ajax_action": "wpforms_admin_forms_overview_delete_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on delete_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-03": {"ajax_action": "wpforms_update_lite_connect_enabled_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on update_lite_connect_enabled_setting \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-04": {"ajax_action": "wpforms_lite_connect_finalize", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on lite_connect_finalize \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-05": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 missing capability check on lite_settings_upgrade AJAX handler", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40765-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-40765", "description": "Collect.chat <=2.4.9 reflected XSS via REQUEST_URI in admin notice (esc_url bypass)", "mode": "block", "severity": 7.1, "slug": "collectchat", "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-40768-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:fix_booking_id", "type": "regex", "value": "~^[0-9]+$~"}, {"name": "ARGS:new_status", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-40768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40768", "description": "Salon Booking System <=10.30.24 unauthenticated IDOR booking modification via fix_booking_id + new_status on wp_ajax_nopriv_salon (CWE-639)", "mode": "block", "severity": 7.3, "slug": "salon-booking-system", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=10.30.24"}, "RULE-CVE-2026-40769-01": {"ajax_action": "cfefd_remove_file", "conditions": [{"name": "ARGS:file_name", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|^/|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|wp-settings\\\\.php|debug\\\\.log))~i"}], "cve": "CVE-2026-40769", "description": "Contact Form Extender for Divi <=1.0.6 unauthenticated arbitrary file deletion via path traversal in file_name parameter", "mode": "block", "severity": 8.6, "slug": "contact-form-extender-for-divi-builder", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-40770-01": {"ajax_action": "wcusage_floating_widget_content", "conditions": [{"name": "ARGS:wcusage_floating_widget_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated XSS via wcusage_floating_widget_content AJAX handler", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40770-02": {"ajax_action": "wcusage_submit_registration", "conditions": [{"name": "ARGS:coupon_code", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated stored XSS via coupon_code in registration form", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "stored"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40770-03": {"ajax_action": "wcusage_submit_registration", "conditions": [{"name": "ARGS:user", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated stored XSS via user parameter in registration form", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "stored"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40770-04": {"ajax_action": "wcusage_submit_registration", "conditions": [{"name": "ARGS:wcu-input-username", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|body|marquee|video|audio|math|table|form|input|button|select|textarea|style|link|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-40770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40770", "description": "Coupon Affiliates <=7.5.3 unauthenticated stored XSS via wcu-input-username in registration form", "mode": "block", "severity": 7.1, "slug": "woo-coupon-usage", "tags": ["xss", "unauthenticated", "stored"], "target": "plugin", "versions": "<=7.5.3"}, "RULE-CVE-2026-40771-01": {"ajax_action": "post_cg_galleries_show_cg_gallery", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_galleries_show_cg_gallery AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40771-02": {"ajax_action": "post_cg_load_v10", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_load_v10 AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40775-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/site(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 unauthenticated broken access control on REST API route /site", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40775-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/(?:posts|pages|media|search)(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 unauthenticated broken access control on REST API content routes (posts, pages, media, search)", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40775-04": {"ajax_action": "royal_mcp_get_platform_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 missing authorization on royal_mcp_get_platform_fields AJAX handler", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40775-05": {"ajax_action": "royal_mcp_test_connection", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40775", "description": "Royal MCP <=1.4.2 missing authorization on royal_mcp_test_connection AJAX handler", "mode": "block", "severity": 7.3, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-40779-01": {"action": "save_link_library_moderate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40779", "description": "Link Library <=7.8.8 contributor+ arbitrary file deletion via admin_post_save_link_library_moderate (missing capability check on moderation handler)", "mode": "block", "severity": 7.7, "slug": "link-library", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=7.8.8"}, "RULE-CVE-2026-40780-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v[0-9]+/(?:[^/]*(?:password|reset|recover|forgot|auth)[^/]*)(?:/|\\\\?|$)~i"}, {"name": "ARGS:email", "type": "regex", "value": "~.+@.+~"}], "cve": "CVE-2026-40780", "description": "BookIt <2.5.4.1 unauthenticated authentication bypass via REST API password recovery exploitation", "mode": "block", "severity": 7.5, "slug": "bookit", "target": "plugin", "versions": "<2.5.4.1"}, "RULE-CVE-2026-40784-01": {"ajax_action": "fluentform_fluent_board_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40784", "description": "FluentBoards <=1.91.2 IDOR via fluentform_fluent_board_config AJAX handler missing authorization", "mode": "block", "severity": 8.1, "slug": "fluent-boards", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.91.2"}, "RULE-CVE-2026-40787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quiz/(?:save_quiz|create_quiz)~"}, {"name": "ARGS:quiz_name", "type": "exists"}, {"name": "ARGS:quiz_name", "type": "regex", "value": "~(?:<[a-z/!?]|[\\"\']\\\\s*(?:on[a-z]+=|style\\\\s*=|xmlns)|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40787", "description": "Stored XSS in Quiz And Survey Master <= 11.0.0 via quiz name/description fields in REST API save_quiz/create_quiz endpoints \\u2014 blocks HTML/script injection patterns in quiz_name parameter for users lacking manage_options", "mode": "block", "severity": 7.1, "slug": "quiz-master-next", "target": "plugin", "versions": "<=11.0.0"}, "RULE-CVE-2026-40791-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:from_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via from_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40791-02": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:test_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via test_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40797-01": {"ajax_action": "date_change_on_no", "conditions": [{"name": "ARGS:wi_webinar_id_resend_mail", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via wi_webinar_id_resend_mail in date_change_on_no AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-02": {"ajax_action": "webinarignition_broadcast_msg_poll", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via id in webinarignition_broadcast_msg_poll AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-03": {"ajax_action": "webinarignition_send_email_verification_code", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via email in webinarignition_send_email_verification_code AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40798-01": {"ajax_action": "wpforo_tag_search", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\'\\\\s*(?:AND|OR)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\'\\\\s*(?:AND|OR)\\\\s+.*(?:SELECT|UNION|CONCAT|VERSION|DATABASE))~i"}], "cve": "CVE-2026-40798", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40798", "description": "wpForo Forum <=3.0.4 unauthenticated SQL injection via q parameter in wpforo_tag_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-4087-01": {"ajax_action": "pprh_update_hints", "conditions": [{"name": "ARGS:pprh_data", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4087", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4087", "description": "Pre* Party Resource Hints <=1.8.20 authenticated (Subscriber+) SQL injection via hint_ids in pprh_data JSON parameter", "mode": "block", "severity": 6.5, "slug": "pre-party-browser-hints", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.8.20"}, "RULE-CVE-2026-4094-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woocs_reset", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4094", "description": "FOX Currency Switcher <=1.4.5 missing authorization allows authenticated users to delete plugin configuration via woocs_reset parameter on admin pages", "mode": "block", "severity": 8.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-4100-02": {"ajax_action": "pmpro_stripe_delete_webhook", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^pmpro_stripe_delete_webhook$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4100", "description": "Paid Memberships Pro <=3.6.5 missing authorization on pmpro_stripe_delete_webhook allows authenticated Subscriber+ users to delete Stripe webhooks and disrupt payment processing", "mode": "block", "severity": 7.1, "slug": "paid-memberships-pro", "tags": ["missing-authorization", "service-disruption"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-4127-01": {"ajax_action": "speedup01_enabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_enabled allows subscriber+ to toggle optimization settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "speedup-optimization", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4127-02": {"ajax_action": "speedup01_purge_all", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_purge_all allows subscriber+ to purge all cache files", "method": "POST", "mode": "block", "severity": 7.5, "slug": "speedup-optimization", "tags": ["missing-authorization", "cache-purge", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4132-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:$|[/?#])~i"}, {"name": "ARGS:hh_htpasswd_path", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp[x]?|jsp[x]?|cfm)|[\\\\\\\\/]\\\\.(?:htaccess|user\\\\.ini)(?:$|[\\\\s?#])~i"}], "cve": "CVE-2026-4132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132", "description": "HTTP Headers <=1.19.2 authenticated RCE via dangerous file extension in hh_htpasswd_path", "method": "POST", "mode": "block", "severity": 7.2, "slug": "http-headers", "tags": ["arbitrary-file-write", "remote-code-execution", "path-traversal"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-4132-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:$|[/?#])~i"}, {"name": "ARGS:hh_htpasswd_path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2026-4132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132", "description": "HTTP Headers <=1.19.2 authenticated RCE via path traversal in hh_htpasswd_path", "method": "POST", "mode": "block", "severity": 7.2, "slug": "http-headers", "tags": ["arbitrary-file-write", "remote-code-execution", "path-traversal"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-4132-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php(?:$|[/?#])~i"}, {"name": "ARGS:hh_www_authenticate_user", "type": "regex", "value": "~(?:^|[;{(\\\\s])<\\\\?(?:php|=|\\\\s)|(?:^|[;{(\\\\s])<%(?![a-z])~i"}], "cve": "CVE-2026-4132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4132", "description": "HTTP Headers <=1.19.2 authenticated RCE via PHP code injection in hh_www_authenticate_user", "method": "POST", "mode": "block", "severity": 7.2, "slug": "http-headers", "tags": ["arbitrary-file-write", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-4143-01": {"ajax_action": "fakturama", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4143", "description": "Neos Connector for Fakturama <=0.0.14 fully unprotected AJAX handler allows CSRF via wp_ajax_fakturama", "mode": "block", "severity": 4.3, "slug": "neos-connector-for-fakturama", "target": "plugin", "versions": "<=0.0.14"}, "RULE-CVE-2026-4146-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=loco-version(?:&|$)~"}, {"name": "ARGS:update_href", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:[^,]*(?:text/html|base64)|[\\"\'><]|on(?:error|load|click|mouseover|focus)\\\\s*=|%(?:22|27|3[CEce]))~i"}], "cve": "CVE-2026-4146", "description": "Loco Translate <=2.8.2 reflected XSS via update_href parameter on admin version page", "mode": "block", "severity": 6.1, "slug": "loco-translate", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2026-42379-04": {"ajax_action": "templately_save_conditions", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "templately_save_conditions"}, {"name": "ARGS:conditions", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42379", "description": "Templately <=3.6.1 unauthorized condition saving via templately_save_conditions AJAX handler missing capability check", "mode": "block", "severity": 7.7, "slug": "templately", "tags": ["missing-authorization", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-42384-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/(?:debug|logs?)(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42384", "description": "Simply Schedule Appointments <1.6.11.2 unauthenticated debug log exposure via REST API (ssa/v1 debug endpoint)", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "target": "plugin", "versions": "<1.6.11.2"}, "RULE-CVE-2026-4248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\{usermeta:[^}]*(?:password_reset_link|user_pass|session_tokens|user_activation_key)[^}]*\\\\}~i"}], "cve": "CVE-2026-4248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4248", "description": "Ultimate Member <=2.11.2 authenticated (Contributor+) sensitive usermeta disclosure via {usermeta:} placeholder in post content", "method": "POST", "mode": "block", "severity": 8.0, "slug": "ultimate-member", "tags": ["insecure-direct-object-reference", "sensitive-data-exposure", "stored-content"], "target": "plugin", "versions": "<=2.11.2"}, "RULE-CVE-2026-4261-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:on_expire_default_to_role", "type": "regex", "value": "~^(?i)(?:administrator|editor|author|contributor)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4261", "description": "Expire Users <=1.2.2 authenticated privilege escalation via profile on_expire_default_to_role parameter", "mode": "block", "severity": 8.8, "slug": "expire-users", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-42649-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "favicon-rotator"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc](?:script|svg|img|iframe|object|embed|body)|(?:^|[^a-z])on(?:error|load|focus|click|mouseover|blur)(?:%3[Dd]|\\\\s*=)|javascript(?:%3[Aa]|\\\\s*:)|<(?:script|svg|img|iframe|object|embed|body)[\\\\s/>])~i"}], "cve": "CVE-2026-42649", "description": "Favicon Rotator <=1.2.11 unauthenticated reflected XSS via unsanitized REQUEST_URI on admin settings page", "mode": "block", "severity": 7.1, "slug": "favicon-rotator", "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2026-42650-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-03": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-04": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42652-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "user-registration-membership-payment-history"}, {"name": "ARGS:action", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]+[^a-zA-Z0-9_]on(?:cl|er|lo|fo|pu)\\\\w*\\\\s*=|[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]\\\\s*:)~i"}], "cve": "CVE-2026-42652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42652", "description": "User Registration <=5.1.5 reflected XSS via action parameter on payment history admin page", "mode": "block", "severity": 7.1, "slug": "user-registration", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=5.1.5"}, "RULE-CVE-2026-42665-01": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via order parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-02": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via orderby parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-03": {"ajax_action": "wpda_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via wpda_autocomplete AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42667-01": {"ajax_action": "bookly_speed_up_update_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42667", "description": "Bookly <=27.4 unauthenticated sensitive data exposure via bookly_speed_up_update_addons AJAX handler", "mode": "block", "severity": 7.5, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.4"}, "RULE-CVE-2026-42668-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/connect(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST connect endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/disconnect-current-site(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST disconnect endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/omnisend-settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST settings endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42678-01": {"ajax_action": "give_get_content_by_ajax", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?iframe[\\\\s>]|<svg[\\\\s/]|<img[^>]+onerror)~i"}], "cve": "CVE-2026-42678", "description": "GiveWP <=4.14.5 authenticated reflected XSS via url parameter in give_get_content_by_ajax AJAX handler", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.5"}, "RULE-CVE-2026-42684-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-03": {"ajax_action": "wpjobportal_ajax_popup_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup_action AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-04": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_loginwith_ajax social login handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42685-01": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS:wpjobportal-social/[a-z]+/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-42685", "description": "WP Job Portal <=2.5.1 unauthenticated reflected XSS via social login parameters in wpjobportal_loginwith_ajax", "mode": "block", "severity": 7.1, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42687-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2026-42687", "description": "EventPrime <=4.3.2.1 unauthenticated PHP Object Injection via unserialize of raw request body in eventprime_api AJAX handler", "mode": "block", "severity": 8.1, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.2.1"}, "RULE-CVE-2026-42727-01": {"ajax_action": "woot_get_table_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_table_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-02": {"ajax_action": "woot_get_columns_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 subscriber+ blind SQL injection via table_html_id in woot_get_columns_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-03": {"ajax_action": "woot_get_smth", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_smth", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42734-01": {"ajax_action": "geo_mashup_kml_attachments", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_kml_attachments", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42734-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_query", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42742-01": {"ajax_action": "_review_action", "conditions": [{"name": "ARGS:view_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\\\\bIF\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\s+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42742", "description": "Views for WPForms Lite <=3.4.6 authenticated blind SQL injection via view_id in _review_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "views-for-wpforms-lite", "tags": ["sql-injection", "blind-sql", "missing-authorization"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-42754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "realfavicongenerator"}, {"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\bon(?:load|error|click|mouse\\\\w+|focus|blur|key\\\\w+|submit)\\\\s*=|<script[^>]*>|javascript\\\\s*:|<(?:iframe|object|embed|svg)[^>]*>~i"}], "cve": "CVE-2026-42754", "description": "Favicon by RealFaviconGenerator <=1.3.46 reflected XSS via query parameters in admin appearance view", "mode": "block", "severity": 7.1, "slug": "favicon-by-realfavicongenerator", "target": "plugin", "versions": "<=1.3.46"}, "RULE-CVE-2026-42756-01": {"ajax_action": "undo_single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in undo_single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-02": {"ajax_action": "single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-03": {"ajax_action": "image_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in image_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42761-02": {"ajax_action": "woot_get_table_data", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^woot_get_table_data$~i"}, {"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:\\\\b(?:UNION(?:\\\\s+ALL)?\\\\s+SELECT|(?:AND|OR)\\\\s+(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|[0-9]{1,6}\\\\s*[=<>]+\\\\s*[0-9]{1,6}|[A-Z0-9_]{1,32}\\\\s*=\\\\s*[\'\\"][^\'\\"]{0,32}[\'\\"]))\\\\b|--[ \\\\t]*$|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}], "cve": "CVE-2026-42761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42761", "description": "Active Products Tables for WooCommerce <=1.0.9 unauthenticated blind SQL injection via table_html_id in woot_get_table_data AJAX handler", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2026-42775-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via orderby parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-42775-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via order parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-4283-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "super-unsubscribe"}, {"name": "ARGS:process_now", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4283", "description": "WP DSGVO Tools (GDPR) <=3.1.38 unauthenticated account destruction via super-unsubscribe process_now branch", "mode": "block", "severity": 9.1, "slug": "shapepress-dsgvo", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "account-destruction"], "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2026-4300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "rbs_gallery_options_loading"}, {"name": "ARGS:rsg_LoadingWord", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|body|iframe|object|embed|div|input|form|style|link|meta|audio|video|source|details|marquee)[\\\\s/>]|<[^>]+\\\\son[a-z]+\\\\s*=|javascript\\\\s*:|%3[Cc]\\\\s*(?:script|svg|img|body|iframe|div|input))~i"}], "cve": "CVE-2026-4300", "description": "Robo Gallery <=5.1.3 authenticated stored XSS via rsg_LoadingWord on rbs_gallery_options_loading settings page", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2026-4302-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optn/v1/integration-action(/|\\\\?|$)~"}, {"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:https?://)?(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|0[.]|0x|\\\\[[:0-9a-fA-F]|localhost))|(?:^(?:gopher|file|dict|ftp|telnet|ldap)://)~i"}], "cve": "CVE-2026-4302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4302", "description": "Optin (optin) <=1.4.29 unauthenticated SSRF via REST API optn/v1/integration-action link parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "optin", "tags": ["ssrf", "unauthenticated", "rest-api", "cwe-918"], "target": "plugin", "versions": "<=1.4.29"}, "RULE-CVE-2026-4303-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through post editor", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4303-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through REST API posts endpoint", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4306-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "getNextJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+=\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4306-02": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:task", "type": "equals", "value": "getNextTemplateJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:\\\\bUNION\\\\b\\\\s+(?:\\\\bALL\\\\b\\\\s+)?\\\\bSELECT\\\\b|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|/\\\\*[^*]*\\\\*+(?:[^/*][^*]*\\\\*+)*/|(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextTemplateJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4326-01": {"ajax_action": "afeb_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-4326", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4326", "description": "Vertex Addons for Elementor <=1.6.4 missing authorization on afeb_activate_required_plugins allows subscriber+ arbitrary plugin installation", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor-builder", "tags": ["missing-authorization", "arbitrary-plugin-installation", "privilege-escalation"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2026-4328-01": {"ajax_action": "demo_download_and_unzip", "conditions": [{"name": "ARGS:demo_file_type", "type": "equals", "value": "url"}, {"name": "ARGS:demo_file", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|ssh2?|telnet|tftp|expect|glob|phar|php|zip|rar|data|ogg|compress\\\\.zlib)\\\\s*:|(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.[0-9]|10\\\\.[0-9]|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?|0177\\\\.|0x7f)(?:[:/]|$))~i"}], "cve": "CVE-2026-4328", "description": "Advanced Import <=1.4.6 authenticated SSRF via demo_file parameter in demo_download_and_unzip AJAX handler", "mode": "block", "severity": 6.4, "slug": "advanced-import", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2026-4329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4329", "description": "Blackhole Bad Bots <=3.8 stored XSS via unescaped bot log data on admin settings page", "mode": "block", "severity": 7.2, "slug": "blackhole-bad-bots", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.8"}, "RULE-CVE-2026-4331-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "b2s_reset_social_meta_tags"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4331", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4331", "description": "Blog2Social <=8.8.2 missing authorization on b2s_reset_social_meta_tags allows subscriber+ deletion of all social meta data", "mode": "block", "severity": 4.3, "slug": "blog2social", "tags": ["missing-authorization", "data-deletion", "authenticated"], "target": "plugin", "versions": "<=8.8.2"}, "RULE-CVE-2026-4333-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|<script|<img|<iframe|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4333", "description": "LearnPress <=4.3.3 Stored XSS via learn_press_courses shortcode skin attribute in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-4333-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|<script|<img|<iframe|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4333", "description": "LearnPress <=4.3.3 Stored XSS via learn_press_courses shortcode skin attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-4335-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/[0-9]+~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter|move)|load|error|keydown|keyup|change|input|submit|reset|drag|drop|pointer(?:down|up|enter|leave))\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4335", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4335", "description": "ShortPixel Image Optimizer <=6.4.3 Author+ stored XSS via attachment post_title rendered unescaped in AI editor popup", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2026-4336-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/ufaq(?:$|[/?]|\\\\?.*)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:script\\\\b[^>]*>.*?</script\\\\s*>|[^>]+\\\\bon(?:click|load|error|mouseover|focus|blur)\\\\s*=|a\\\\b[^>]+\\\\bhref\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|img\\\\b[^>]+\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~is"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ content submitted to REST API /wp/v2/ufaq", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "ufaq"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[ />]|<[^>]+on(?:click|load|error|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&lt;script|&lt;[^&]*on(?:click|load|error|mouseover|focus|blur)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ post_content submitted through wp-admin/post.php editor", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4338-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitypub/1\\\\.0/outbox(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4338", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4338", "description": "ActivityPub <8.0.2 unauthenticated information disclosure of draft/scheduled/pending posts via site-level outbox REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "activitypub", "tags": ["information-disclosure", "rest-api", "unauthenticated", "improper-access-control"], "target": "plugin", "versions": "<8.0.2"}, "RULE-CVE-2026-4341-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:actions", "type": "regex", "value": "~follow_us_text[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor AJAX save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~follow_us_text[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor REST save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4347-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via file upload move flow (generate_user_filepath / move_temp_file_to_upload_dir)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4347-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|phs|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via crafted uploaded filename in file field", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4365-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "delete_question_answer"}, {"type": "missing_capability", "value": "edit_lp_courses"}], "cve": "CVE-2026-4365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4365", "description": "LearnPress <=4.3.2.8 unauthenticated arbitrary quiz answer deletion via lp-ajax delete_question_answer", "method": "POST", "mode": "block", "severity": 9.1, "slug": "learnpress", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-4373-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-02": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in post.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4388-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in fm_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4388-02": {"action": "init", "conditions": [{"name": "ARGS:fm_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in non-AJAX form submission", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through REST API wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4484-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/masteriyo/v1/users/instructors/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:roles", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4484", "description": "Masteriyo LMS <=2.1.6 authenticated (Student+) privilege escalation to administrator via roles parameter in instructors REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2026-45218-01": {"action": "wp_ajax_nopriv_wp_travel_update_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_update_trip unauthenticated endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-02": {"action": "wp_ajax_nopriv_wp_travel_get_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_trip without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-03": {"action": "wp_ajax_wp_travel_get_pricings", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_pricings without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-04": {"action": "wp_ajax_nopriv_wptravel_save_user_enquiry", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wptravel_save_user_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-05": {"action": "wp_ajax_nopriv_wp_travel_add_to_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_add_to_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-06": {"action": "wp_ajax_nopriv_wp_travel_get_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-07": {"action": "wp_ajax_delete_itinerary_enquiry", "conditions": [{"name": "ARGS:enquiry_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via delete_itinerary_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45437-01": {"ajax_action": "eszlwcf_filter_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_filter_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45437-02": {"ajax_action": "eszlwcf_load_more_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_load_more_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45439-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:import)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API import endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-45439-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:update)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API update endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4561-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:/text_subscribed|text_error/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|mouseleave|focus|blur)\\\\s*=|(?:javascript|data)\\\\s*:)~i"}], "cve": "CVE-2026-4561", "description": "MC4WP Mailchimp for WordPress <=4.12.0 Author+ stored XSS via text_subscribed/text_error form message post meta", "mode": "block", "slug": "mailchimp-for-wp", "target": "plugin", "versions": "<=4.12.0"}, "RULE-CVE-2026-4655-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:options", "type": "regex", "value": "~bdt-svg-image~i"}, {"name": "ARGS:options", "type": "regex", "value": "~(?:%3C|<)\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*(?:=|%3D)|javascript\\\\s*(?::|%3A)|%253[Cc]script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4655", "description": "Element Pack Lite <=8.4.2 contributor+ stored XSS via SVG Image widget svg_source on elementor_ajax", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-4658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block class attributes (REST post save - className)", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4658-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~wp:essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&quot;javascript)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block markup in any request body", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4659-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]+){2,}|/etc/passwd|[/\\\\\\\\](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-4659", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4659", "description": "Unlimited Elements for Elementor <=2.0.6 authenticated contributor+ arbitrary file read via path traversal in Repeater JSON/CSV URL within Elementor widget settings", "mode": "block", "severity": 7.5, "slug": "unlimited-elements-for-elementor", "tags": ["path-traversal", "arbitrary-file-read", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2026-4664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ivole/v1/review(?:[/?&]|$)~"}, {"name": "ARGS:key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-4664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4664", "description": "Customer Reviews for WooCommerce <=5.103.0 unauthenticated authentication bypass on POST /ivole/v1/review via empty key parameter against ivole_secret_key meta", "method": "POST", "mode": "block", "severity": 5.3, "slug": "customer-reviews-woocommerce", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.103.0"}, "RULE-CVE-2026-4665-01": {"ajax_action": "wpcf_image_save_meta", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*\\\\son(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/>]|<img[^>]+onerror|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-4665", "description": "WP Carousel Free <=2.7.10 stored DOM XSS via crafted data-caption in wpcf_image_save_meta AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.7.10"}, "RULE-CVE-2026-4665-02": {"ajax_action": "wpcp_import_shortcodes", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*\\\\son(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/>]|<img[^>]+onerror|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-4665", "description": "WP Carousel Free <=2.7.10 stored DOM XSS via shortcodes import containing malicious data-caption payloads", "mode": "block", "severity": 6.4, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.7.10"}, "RULE-CVE-2026-4703-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-4703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4703", "description": "WS Form LITE <=1.10.80 unauthenticated PHP object injection via unsafe deserialization of form submission meta values", "mode": "block", "severity": 9.8, "slug": "ws-form", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.10.80"}, "RULE-CVE-2026-4758-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4758-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax_popup", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4785-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (post.php save)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (heartbeat autosave)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (REST API)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4790-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:custom_svg", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\son(?:load|error|click|mouseover|focus|animationstart|animationend)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4790", "description": "Premium Addons for Elementor <=4.11.70 contributor+ stored XSS via custom_svg parameter (CWE-79)", "mode": "block", "severity": 5.4, "slug": "premium-addons-for-elementor", "target": "plugin", "versions": "<=4.11.70"}, "RULE-CVE-2026-4801-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?(?:icalFeedUrl|eventsTitle|eventsDescription|eventsLocation)[\\\\s\\\\S]*?<[^>]+(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed attributes in Gutenberg REST API", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4801-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?icalFeedUrl[\\\\s\\\\S]*?(?:javascript\\\\s*:|<[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed URL attribute", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4812-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/post_object/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated post_object enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/relationship/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated relationship enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/page_link/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated page_link enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/user/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated user enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/select/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated select enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/taxonomy/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated taxonomy enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4817-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s+(?:UNION|SELECT|DROP|DELETE|INSERT|UPDATE|TABLE|INTO|VALUES|FROM|WHERE|version)\\\\s)~i"}], "cve": "CVE-2026-4817", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4817", "description": "MasterStudy LMS <=3.7.25 SQL injection via orderby parameter in stm-lms/order/items REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.25"}, "RULE-CVE-2026-4880-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "barcodeScannerConfigs"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX action (GET or POST)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-02": {"ajax_action": "setUserMeta", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via setUserMeta AJAX action (wp_capabilities)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]action=barcodeScannerConfigs(?:&|$)~"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX GET request (REQUEST_URI detection)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]barcode-scanner-lite-pos-to-manage-products-inventory-and-orders[/\\\\\\\\]request\\\\.php~"}, {"name": "ARGS:route", "type": "equals", "value": "setUserMeta"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via direct request.php setUserMeta endpoint (wp_capabilities)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-48835-01": {"ajax_action": "wpforms_connect_process", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48835", "description": "WPForms Lite <=1.10.0.4 unauthenticated broken access control via wpforms_connect_process AJAX handler", "mode": "block", "severity": 7.5, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.10.0.4"}, "RULE-CVE-2026-48874-01": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via orderby in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48874-02": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via order in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48876-01": {"ajax_action": "sfs_sub", "conditions": [{"name": "ARGS:comment_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via comment_id in sfs_sub AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-02": {"ajax_action": "sfs_process", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via ip parameter in sfs_process AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-03": {"ajax_action": "sfs_process", "conditions": [{"name": "ARGS:func", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via func parameter in sfs_process AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-04": {"ajax_action": "sfs_process", "conditions": [{"name": "ARGS:cont", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via cont parameter in sfs_process AJAX handler", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48876-05": {"action": "init", "conditions": [{"name": "ARGS:ocimg", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-48876", "description": "Stop Spammers <=2026.3 unauthenticated reflected XSS via ocimg parameter in kpg_ss_init hook", "mode": "block", "severity": 7.1, "slug": "stop-spammer-registrations-plugin", "target": "plugin", "versions": "<=2026.3"}, "RULE-CVE-2026-48882-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48882", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-48882", "description": "WP Time Slots Booking Form <=1.2.50 subscriber+ SQL injection via wpts_run_email_diagnostic AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-time-slots-booking-form", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.50"}, "RULE-CVE-2026-4896-01": {"ajax_action": "delete_wcfm_product", "conditions": [{"name": "ARGS:proid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_product allows authenticated users to delete arbitrary products without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-02": {"ajax_action": "delete_wcfm_article", "conditions": [{"name": "ARGS:articleid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_article allows authenticated users to delete arbitrary articles without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-03": {"ajax_action": "wcfm_modify_order_status", "conditions": [{"name": "ARGS:orderid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on wcfm_modify_order_status allows authenticated users to modify status of arbitrary orders without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-48964-01": {"ajax_action": "eh_crm_settings_initiate_ticket", "conditions": [{"name": "ARGS:start_number", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d+\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-48964", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.6 authenticated SQL injection via start_number in eh_crm_settings_initiate_ticket AJAX handler", "mode": "block", "severity": 8.5, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.6"}, "RULE-CVE-2026-48968-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_params in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_id in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via orderby in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via order in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-49044-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "acffa_settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-49044", "description": "Advanced Custom Fields: Font Awesome Field <=5.0.2 authenticated stored XSS via acffa_settings option values", "mode": "block", "severity": 6.5, "slug": "advanced-custom-fields-font-awesome", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-49055-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]*\\\\bsrc\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated reflected XSS via path parameter in dnd_codedropz_upload_delete", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49055-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "FILES:upload-file:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]*\\\\bsrc\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated stored XSS via uploaded filename in dnd_codedropz_upload", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49060-01": {"ajax_action": "hippoo_save_permission_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49060", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 authenticated privilege escalation via hippoo_save_permission_role AJAX handler", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-49060-02": {"ajax_action": "hippoo_add_permission_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49060", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 authenticated privilege escalation via hippoo_add_permission_role AJAX handler", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-49060-03": {"ajax_action": "hippoo_delete_permission_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49060", "description": "Hippoo Mobile App for WooCommerce <=1.9.4 authenticated privilege escalation via hippoo_delete_permission_role AJAX handler", "mode": "block", "severity": 9.8, "slug": "hippoo", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2026-49063-01": {"ajax_action": "lsd_register", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_register (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-02": {"ajax_action": "lsd_login", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_login (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-03": {"ajax_action": "lsd_activation", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Authenticated Privilege Escalation via lsd_activation (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49067-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^yydev[_-]redirect~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-49067", "description": "Advanced 301 and 302 Redirect <=1.6.9 unauthenticated SQL injection via id parameter on admin page endpoint", "mode": "block", "severity": 9.3, "slug": "advanced-301-and-302-redirect", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-49069-01": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via taxonomy parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-02": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:term", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via term parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-03": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via orderby parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-04": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via order parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49085-01": {"action": "init", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~Tzo|Qzo~"}], "cve": "CVE-2026-49085", "description": "WP Insightly for CF7 <=1.1.4 unauthenticated PHP object injection via base64-encoded data parameter", "mode": "block", "severity": 9.8, "slug": "cf7-insightly", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-49104-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:/|\\\\\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\{]~"}], "cve": "CVE-2026-49104", "description": "Integration for Keap/Infusionsoft and Contact Form 7 <=1.2.1 unauthenticated PHP object injection via CF7 form field deserialization", "mode": "block", "severity": 9.8, "slug": "cf7-infusionsoft", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-49106-01": {"ajax_action": "get_objects_9658", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49106", "description": "Integration for Contact Form 7 and Constant Contact <=1.1.6 missing authorization on get_objects_9658 AJAX handler allows subscriber+ PHP Object Injection via stored feed meta", "mode": "block", "severity": 9.8, "slug": "cf7-constant-contact", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-49106-02": {"ajax_action": "get_field_map_9658", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49106", "description": "Integration for Contact Form 7 and Constant Contact <=1.1.6 missing authorization on get_field_map_9658 AJAX handler allows subscriber+ PHP Object Injection via stored feed meta", "mode": "block", "severity": 9.8, "slug": "cf7-constant-contact", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-49112-01": {"action": "init", "conditions": [{"name": "ARGS:_sf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-49112", "description": "Shared Files <=1.7.64 unauthenticated path traversal via _sf_file query var leading to arbitrary file read", "mode": "block", "severity": 7.5, "slug": "shared-files", "target": "plugin", "versions": "<=1.7.64"}, "RULE-CVE-2026-49112-02": {"action": "init", "conditions": [{"name": "ARGS:_SF_GOTO", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|https?://(?!(?:[a-z0-9-]+\\\\.)*(?:wordpress\\\\.org|w\\\\.org)(?:[/?#]|$)))~i"}], "cve": "CVE-2026-49112", "description": "Shared Files <=1.7.64 unauthenticated path traversal/open redirect via _SF_GOTO query var", "mode": "block", "severity": 7.5, "slug": "shared-files", "target": "plugin", "versions": "<=1.7.64"}, "RULE-CVE-2026-4935-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "suretriggers-status"}, {"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4935", "description": "SureTriggers <=1.1.22 authenticated SQL injection via status_filter parameter", "mode": "block", "severity": 8.6, "slug": "suretriggers", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.1.22"}, "RULE-CVE-2026-49763-01": {"action": "init", "conditions": [{"name": "ARGS:code", "type": "exists"}, {"name": "ARGS:state", "type": "regex", "value": "~(?:%(?:4[Ff]|6[Ff]|43|63|61|41)|[OCa])(?:%3[Aa]|:)[0-9]~i"}], "cve": "CVE-2026-49763", "description": "Integration for Contact Form 7 HubSpot <=1.3.7 unauthenticated PHP Object Injection via state parameter in OAuth callback", "mode": "block", "severity": 9.8, "slug": "cf7-hubspot", "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2026-49764-01": {"ajax_action": "rm_activate_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49764", "description": "Block unauthenticated access to rm_activate_user AJAX handler (CWE-288 Authentication Bypass) in RegistrationMagic <= 6.0.8.6", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.8.6"}, "RULE-CVE-2026-49764-02": {"ajax_action": "rm_login_social_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49764", "description": "Block unauthenticated access to rm_login_social_user AJAX handler (CWE-288 Authentication Bypass) in RegistrationMagic <= 6.0.8.6", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.8.6"}, "RULE-CVE-2026-49765-01": {"action": "init", "conditions": [{"name": "ARGS:vx_data", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2026-49765", "description": "Integration for Mailchimp and CF7 <=1.1.8 - PHP Object Injection via vx_data on init hook (unauthenticated)", "mode": "block", "severity": 9.8, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-49765-02": {"ajax_action": "update_feed_mc", "conditions": [{"name": "ARGS:vx_data", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2026-49765", "description": "Integration for Mailchimp and CF7 <=1.1.8 - Authenticated PHP Object Injection via vx_data in update_feed_mc AJAX handler", "mode": "block", "severity": 9.8, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-49766-01": {"action": "init", "conditions": [{"name": "ARGS:current_user_avatar", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-49766", "description": "WP User Manager <=2.9.16 subscriber+ arbitrary file deletion via path traversal in current_user_avatar", "mode": "block", "severity": 9.9, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.16"}, "RULE-CVE-2026-49766-02": {"action": "init", "conditions": [{"name": "ARGS:current_user_cover", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-49766", "description": "WP User Manager <=2.9.16 subscriber+ arbitrary file deletion via path traversal in current_user_cover", "mode": "block", "severity": 9.9, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.16"}, "RULE-CVE-2026-49767-01": {"ajax_action": "wpforo_confirm_current_user_password", "conditions": [{"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-49767", "description": "wpForo Forum <=3.1.0 unauthenticated broken authentication via wpforo_confirm_current_user_password AJAX handler", "mode": "block", "severity": 9.8, "slug": "wpforo", "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-49769-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49769", "description": "wpForo Forum <=3.1.0 unauthenticated PHP Object Injection via serialized parameter", "mode": "block", "severity": 9.8, "slug": "wpforo", "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-49770-01": {"ajax_action": "wte_onboard_dynamic_recommendation", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wte_onboard_dynamic_recommendation AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-02": {"ajax_action": "email_test", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via email_test AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-03": {"ajax_action": "wte_fxn_clone_trip_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wte_fxn_clone_trip_data AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-04": {"ajax_action": "wptravelengine_send_test_email", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wptravelengine_send_test_email AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49771-01": {"ajax_action": "bwg_frontend_data", "conditions": [{"name": "ARGS:sortImagesByValue_/[0-9]+/", "type": "regex", "value": "~(?:(?:\\\\bAND\\\\b|\\\\bOR\\\\b)\\\\s+[\\\\d\'\\"(]|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bWAITFOR\\\\b|--\\\\s*[-#]|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\s)~i"}], "cve": "CVE-2026-49771", "description": "Photo Gallery by 10Web <=1.8.41 blind SQL injection via sortImagesByValue parameter in bwg_frontend_data AJAX handler (unauthenticated)", "mode": "block", "severity": 7.6, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.41"}, "RULE-CVE-2026-49771-02": {"ajax_action": "GalleryBox", "conditions": [{"name": "ARGS:sortImagesByValue_/[0-9]+/", "type": "regex", "value": "~(?:(?:\\\\bAND\\\\b|\\\\bOR\\\\b)\\\\s+[\\\\d\'\\"(]|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bWAITFOR\\\\b|--\\\\s*[-#]|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\s)~i"}], "cve": "CVE-2026-49771", "description": "Photo Gallery by 10Web <=1.8.41 blind SQL injection via sortImagesByValue parameter in GalleryBox AJAX handler (unauthenticated)", "mode": "block", "severity": 7.6, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.41"}, "RULE-CVE-2026-49772-01": {"action": "init", "conditions": [{"name": "ARGS:event_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 unauthenticated blind SQL injection via event_ids parameter on attendee registration page", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49772-02": {"ajax_action": "tec_qr_code_modal", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 authenticated blind SQL injection via post_id in tec_qr_code_modal AJAX handler", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49774-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:rd_station_form_identifier", "type": "exists"}, {"name": "ARGS:rd_station_form_identifier", "type": "regex", "value": "~(?:php://|data://|phar://|expect://|glob://|(?:\\\\.\\\\.[\\\\\\\\/]){2,}|<script[\\\\s/>]|javascript\\\\s*:|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 stored code injection via rd_station_form_identifier metabox field blocked for users lacking edit_others_posts capability", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-02": {"ajax_action": "rd-persist-tokens", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rd-persist-tokens AJAX handler (CWE-862)", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-03": {"ajax_action": "rd-persist-legacy-tokens", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rd-persist-legacy-tokens AJAX handler (CWE-862)", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-04": {"ajax_action": "rdsm-disconnect-oauth", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-disconnect-oauth AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-05": {"ajax_action": "rdsm-update-tracking-code-status", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-update-tracking-code-status AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-08": {"ajax_action": "rdsm-authorization-check", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-authorization-check AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49774-09": {"ajax_action": "rdsm-custom-fields", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-49774", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49774", "description": "RD Station <=5.6.0 missing authorization on rdsm-custom-fields AJAX handler (CWE-862) - blocks contributor and below", "mode": "block", "severity": 9.9, "slug": "integracao-rd-station", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-49776-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|MAKE_SET|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-49776", "description": "GPTranslate <=2.32.6 unauthenticated SQL injection via id parameter in gptranslate/v1/request REST endpoint", "mode": "block", "severity": 9.3, "slug": "gptranslate", "target": "plugin", "versions": "<=2.32.6"}, "RULE-CVE-2026-49781-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/suretriggers/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49781", "description": "OttoKit (SureTriggers) <=1.1.27 unauthenticated PHP object injection via REST API", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2026-4987-01": {"ajax_action": "srfm_create_payment_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_payment_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4987-02": {"ajax_action": "srfm_create_subscription_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_subscription_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-5127-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpuf_submit_post"}, {"name": "ARGS:wpuf_files", "type": "regex", "value": "~(?:^|[^a-zA-Z0-9])(?:O|C|a):[0-9]+:(?:\\"|%22|%2522)~i"}], "cve": "CVE-2026-5127", "description": "WP User Frontend <=4.3.1 PHP object injection via wpuf_files parameter on admin-ajax.php action=wpuf_submit_post", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2026-5149-01": {"ajax_action": "get_submission_content", "conditions": [{"name": "ARGS:entries_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5149", "description": "RTMKit <=2.0.7 missing authorization on get_submission_content allows contributor+ to view arbitrary form submissions via entries_id IDOR", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-5159-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/(?:admin-ajax\\\\.php|post\\\\.php|admin-post\\\\.php)~i"}, {"name": "ARGS", "type": "regex", "value": "~instagram_follow_text[\\"\'\\\\\\\\\\\\s:]+[^\\"\']*(?:<[a-zA-Z/!]|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-5159", "description": "Royal Elementor Addons <=1.7.1056 Contributor+ stored XSS via Instagram Feed widget instagram_follow_text setting", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-5162-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:elementor_data", "type": "regex", "value": "~instagram_follow_text[^}]{0,4000}?(?:<(?:\\\\\\\\?/?)?(?:script[\\\\s/>]|iframe|object|embed|applet|svg|img\\\\b)|on(?:error|load|click|mouseover|mouseout|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5162", "description": "Royal Elementor Addons <=1.7.1056 stored XSS via instagram_follow_text in Instagram Feed widget", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-5192-01": {"ajax_action": "forminator_submit_form_cform", "conditions": [{"name": "ARGS:upload-1[file][file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via upload-1[file][file_path] in form submit AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5192-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS:file_data[file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via file_data[file_path] in multiple file upload AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5200-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "acymailing_router"}, {"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5200", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5200", "description": "AcyMailing <=10.8.2 missing authorization on acymailing_router allows authenticated subscriber+ privilege escalation", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=10.8.2"}, "RULE-CVE-2026-5207-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (AJAX vector)", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5207-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "llms-reporting"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (admin page vector)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5229-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/form-notify/v1/callback(?:[/?]|$)~"}, {"name": "REQUEST_COOKIES:form_notify_line_email", "type": "exists"}], "cve": "CVE-2026-5229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5229", "description": "Form Notify <=1.1.10 unauthenticated authentication bypass via form_notify_line_email cookie on LINE OAuth callback", "mode": "block", "severity": 9.8, "slug": "form-notify", "tags": ["authentication-bypass", "improper-authentication", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2026-5231-01": {"action": "admin_init", "conditions": [{"name": "ARGS:tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on[a-z]+=|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-5231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5231", "description": "WP Statistics <=14.16.4 reflected XSS via unsanitized tab parameter in admin template", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "reflected", "admin-template"], "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-52693-01": {"ajax_action": "get_viariation_details", "conditions": [{"name": "ARGS:cart_content[/\\\\d+/]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via cart_content in get_viariation_details AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52693-02": {"ajax_action": "shopping_cart_products", "conditions": [{"name": "ARGS:raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via raw parameter in shopping_cart_products AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52694-01": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:invitation", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~i"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive data exposure via document and invitation parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-02": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:download", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive document download via document and download parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-03": {"ajax_action": "esig_create_order_agreement", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 missing authorization on esig_create_order_agreement AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52697-01": {"ajax_action": "wppm_filter_autocomplete", "conditions": [{"name": "ARGS:project_search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_search in wppm_filter_autocomplete AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:project_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_id in wppm_get_project_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-03": {"ajax_action": "wppm_get_task_list", "conditions": [{"name": "ARGS:task_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via task_id in wppm_get_task_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-04": {"ajax_action": "wppm_edit_task_status", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via id parameter in wppm_edit_task_status AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-05": {"ajax_action": "wppm_get_task_list_card_view", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via page_no in wppm_get_task_list_card_view AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-06": {"ajax_action": "wppm_drag_and_drop_card", "conditions": [{"name": "ARGS:proj_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via proj_ids in wppm_drag_and_drop_card AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52702-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-redirection.php"}, {"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3Cscript|%3[Ee]|<img[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 unauthenticated reflected XSS via redirect_from parameter on admin page", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52702-02": {"ajax_action": "customAddUpdate", "conditions": [{"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:\'|%27)\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 authenticated SQL injection via redirect_from in customAddUpdate AJAX handler", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/download(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/download REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/view-log(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/view-log REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/template/directory-tree(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via template/directory-tree REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5294-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5294", "description": "Geeky Bot <=1.2.2 unauthenticated arbitrary plugin installation via geekybot_frontendajax AJAX handler", "mode": "block", "severity": 9.8, "slug": "geeky-bot", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-5324-01": {"ajax_action": "brizy_form_submit", "conditions": [{"name": "ARGS:data[fields][FileUpload]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5324", "description": "Brizy \\u2013 Page Builder <=2.8.11 unauthenticated stored XSS via form submission FileUpload field value", "mode": "block", "severity": 7.2, "slug": "brizy", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2026-5364-01": {"ajax_action": "cf7_file_uploads", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:^|\\\\|)\\\\s*(?:ph(?:p[2-9s]?|tml?|ar)|s?html?|cgi|aspx?|jspx?|cfm|htaccess|user\\\\.ini)\\\\s*(?:\\\\||$)~i"}], "cve": "CVE-2026-5364", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5364", "description": "Drag and Drop File Upload for Contact Form 7 <=1.1.3 unauthenticated arbitrary PHP file upload via extension validation bypass in cf7_file_uploads AJAX handler", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-file-upload-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "extension-bypass"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2026-5371-01": {"ajax_action": "monsterinsights_ads_get_token", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google OAuth access tokens via monsterinsights_ads_get_token AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "oauth-token-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-02": {"ajax_action": "monsterinsights_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized reset of Google Ads integration via monsterinsights_ads_reset_experience AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "integration-reset"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-03": {"ajax_action": "monsterinsights_ads_get_settings", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google Ads settings via monsterinsights_ads_get_settings AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "information-disclosure", "settings-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5399-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~i"}, {"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[0-9]+(?:\\\\.[0-9]+)?\\\\s+[^\\"\'<>]{0,80}?\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2026-5399", "description": "Redux Framework <=4.5.13.1 authenticated (subscriber+) stored XSS via slider field attribute breakout in profile save handler", "mode": "block", "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13.1"}, "RULE-CVE-2026-5400-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~i"}, {"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|mouseout|click|dblclick|focus|blur|change|input|submit|keydown|keyup)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-5400", "description": "Redux Framework <=4.5.13 subscriber+ stored XSS via unsanitized nested Media field filter value in profile save (user_meta_save)", "mode": "block", "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13"}, "RULE-CVE-2026-5410-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|mouseout|click|dblclick|focus|blur|change|keyup|keydown|submit|animationstart|pointerover|focusin)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5410", "description": "Redux Framework <=4.5.13 authenticated (subscriber+) stored XSS via spinner field in own profile save (user_meta_save)", "mode": "block", "severity": 6.4, "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13"}, "RULE-CVE-2026-5410-02": {"action": "edit_user_profile_update", "conditions": [{"name": "ARGS:redux_users_meta_nonce", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|mouseout|click|dblclick|focus|blur|change|keyup|keydown|submit|animationstart|pointerover|focusin)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5410", "description": "Redux Framework <=4.5.13 authenticated (subscriber+) stored XSS via spinner field when saving another user\'s profile (user_meta_save)", "mode": "block", "severity": 6.4, "slug": "redux-framework", "target": "plugin", "versions": "<=4.5.13"}, "RULE-CVE-2026-54191-01": {"ajax_action": "pq_loadpod", "conditions": [{"name": "ARGS:pod", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on[a-z]+=|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-54191", "description": "Pods <=3.3.8 reflected XSS via pod parameter in pq_loadpod AJAX handler", "mode": "block", "severity": 7.1, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2026-54192-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:ays_pb_tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via ays_pb_tab parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54192-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:popup_category", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via popup_category parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54192-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via type parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54192-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "ays-pb"}, {"name": "ARGS:popupbox", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-54192", "description": "Popup Box <=6.2.9 unauthenticated reflected XSS via popupbox parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.2.9"}, "RULE-CVE-2026-54196-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS:_jf_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-54196", "description": "JetFormBuilder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation via Update User Action", "mode": "block", "severity": 6.8, "slug": "jetformbuilder", "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-5425-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/trustindex-feed-instagram/v1/webhook(?:[/?]|$)~"}, {"name": "ARGS:data[feed_data]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5425", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5425", "description": "Social Photo Feed Widget <=1.7.9 unauthenticated stored XSS via REST webhook feed_data injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "social-photo-feed-widget", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.9"}, "RULE-CVE-2026-5427-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|templates|template-parts)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"kubio\\"[\\\\s\\\\S]{0,1000}?\\\\bhttps?://~i"}, {"name": "", "type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-5427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5427", "description": "Kubio AI Page Builder <=2.7.2 missing authorization on rest_pre_insert allows contributor-level arbitrary remote file import via kubio block attribute URL", "mode": "block", "severity": 5.3, "slug": "kubio", "tags": ["missing-authorization", "arbitrary-file-upload", "authenticated"], "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5465-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:call", "type": "regex", "value": "~users/providers/~i"}, {"name": "ARGS:externalId", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-5465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5465", "description": "Amelia Booking <=2.1.3 IDOR account takeover via externalId in provider profile update (wpamelia_api)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ameliabooking", "tags": ["idor", "account-takeover", "insecure-direct-object-reference", "authenticated"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-5478-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}(?:.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))?~i"}], "cve": "CVE-2026-5478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5478", "description": "Everest Forms <=3.4.4 unauthenticated arbitrary file read and deletion via path traversal in old_files parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "everest-forms", "tags": ["path-traversal", "local-file-inclusion", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.4.4"}, "RULE-CVE-2026-54802-01": {"ajax_action": "process_campaign", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54802", "description": "Block unauthenticated access to process_campaign AJAX action (CWE-862 Missing Authorization)", "mode": "block", "severity": 7.5, "slug": "sms-alert", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2026-54805-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:falang_user", "type": "exists"}, {"name": "ARGS:user_id", "type": "not_current_user"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-54805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54805", "description": "Falang multilanguage <=1.4.2 subscriber+ privilege escalation via profile update IDOR (personal_options_update)", "mode": "block", "severity": 8.8, "slug": "falang", "tags": ["privilege-escalation", "missing-authorization", "idor"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-54805-02": {"action": "edit_user_profile_update", "conditions": [{"name": "ARGS:falang_user", "type": "exists"}, {"name": "ARGS:user_id", "type": "not_current_user"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-54805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54805", "description": "Falang multilanguage <=1.4.2 subscriber+ privilege escalation via profile update IDOR (edit_user_profile_update)", "mode": "block", "severity": 8.8, "slug": "falang", "tags": ["privilege-escalation", "missing-authorization", "idor"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-54810-01": {"ajax_action": "build_payment_payload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on build_payment_payload AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-02": {"ajax_action": "apple_pay_validate_merchant", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on apple_pay_validate_merchant AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-03": {"ajax_action": "validate_checkout_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on validate_checkout_form AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-04": {"ajax_action": "get_build_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on get_build_fields AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54813-01": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-02": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-03": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-04": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54814-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 unauthenticated local file inclusion via template parameter in mvl_motors_starter_template AJAX handler", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54814-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 missing authorization on mvl_motors_starter_demo_install allows unauthenticated file write/delete", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "arbitrary-file-write", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54818-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:pageview_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|\\\\b(?:AND|OR)\\\\s+(?:\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54818", "description": "Slimstat Analytics <=5.4.11 authenticated (Subscriber+) blind SQL injection via pageview_id in slimstat_load_report AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<=5.4.11"}, "RULE-CVE-2026-54819-01": {"ajax_action": "lsd_accordion_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in accordion sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-02": {"ajax_action": "lsd_grid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in grid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-03": {"ajax_action": "lsd_list_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in list sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-04": {"ajax_action": "lsd_gallery_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in gallery sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-05": {"ajax_action": "lsd_halfmap_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in halfmap sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-06": {"ajax_action": "lsd_masonry_load_more", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in masonry load_more AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-07": {"ajax_action": "lsd_mosaic_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in mosaic sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-08": {"ajax_action": "lsd_listgrid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in listgrid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-09": {"ajax_action": "lsd_side_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in side sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-10": {"ajax_action": "lsd_table_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in table sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-11": {"ajax_action": "lsd_timeline_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in timeline sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54821-01": {"ajax_action": "vlp_get_template", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54821", "description": "Visual Link Preview <=2.3.1 subscriber+ sensitive data exposure via vlp_get_template AJAX handler missing capability check", "mode": "block", "severity": 7.4, "slug": "visual-link-preview", "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-54822-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/salesmanago/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54822", "description": "SALESmanago & Leadoo <=3.11.2 subscriber+ SQL injection via REST API endpoint", "mode": "block", "severity": 8.5, "slug": "salesmanago", "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-54823-01": {"ajax_action": "widgetopts_get_settings_ajax", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-54823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54823", "description": "Widget Options <=4.2.3 authenticated (Contributor+) broken access control on arbitrary post_id via widgetopts_get_settings_ajax AJAX handler", "mode": "pass", "severity": 9.9, "slug": "widget-options", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=4.2.3"}, "RULE-CVE-2026-54825-01": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS:table_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54825", "description": "wpDataTables <=7.4 unauthenticated SQL injection via table_id in wdtable_update_cache AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpdatatables", "target": "plugin", "versions": "<=7.4"}, "RULE-CVE-2026-54828-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_template AJAX handler (LFI via include sink)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54828-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_demo_install AJAX handler (file_put_contents/unlink sinks)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54831-01": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_order in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-02": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:package_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via package_id in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-03": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_by in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54832-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-essence/v1/gutenverse-essence-proxy~"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-54832", "description": "Block unauthenticated access to gutenverse-essence REST proxy route (missing authorization \\u2013 permission_callback was __return_true in <=2.5.0)", "mode": "block", "severity": 7.5, "slug": "gutenverse-companion", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2026-54836-01": {"ajax_action": "ymc_get_posts", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via order parameter in ymc_get_posts AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-02": {"ajax_action": "ymc_get_posts", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via orderby parameter in ymc_get_posts AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-03": {"ajax_action": "ymc_autocomplete_search", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via order parameter in ymc_autocomplete_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-04": {"ajax_action": "ymc_autocomplete_search", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via orderby parameter in ymc_autocomplete_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-05": {"ajax_action": "get_post_popup", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via order parameter in get_post_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54836-06": {"ajax_action": "get_post_popup", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54836", "description": "YMC Filter <=3.11.5 unauthenticated SQL injection via orderby parameter in get_post_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "ymc-smart-filter", "target": "plugin", "versions": "<=3.11.5"}, "RULE-CVE-2026-54840-01": {"ajax_action": "newsletters_forms_createform", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_createform AJAX handler allows subscriber+ form creation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-02": {"ajax_action": "newsletters_forms_addfield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_addfield AJAX handler allows subscriber+ form field addition", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-03": {"ajax_action": "newsletters_forms_deletefield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_deletefield AJAX handler allows subscriber+ form field deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-04": {"ajax_action": "newsletters_admin_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_admin_mode AJAX handler allows subscriber+ admin mode toggle", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-05": {"ajax_action": "newsletters_change_themefolder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_change_themefolder AJAX handler allows subscriber+ theme folder change", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-06": {"ajax_action": "newsletters_delete_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_delete_option AJAX handler allows subscriber+ option deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-07": {"ajax_action": "newsletters_pause_queue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_pause_queue AJAX handler allows subscriber+ queue manipulation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/apbd-vtpos/v1/(?:current-user|get-logged-user|cashier-details|cash-drawer-info|cash-drawer-list|all-outlet-list|all-categories|all-taxes|heart-bit|list|details|end-of-day-data|categories|countries|attributes|getStock|close-cash-drawer|logout|email)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54841", "description": "VitePOS Lite <=3.4.2 unauthenticated sensitive data exposure via REST API endpoints missing permission callbacks", "mode": "block", "severity": 7.5, "slug": "vitepos-lite", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2026-54842-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/messages(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54842", "description": "Royal MCP <=1.4.25 missing authorization on royal-mcp/v1/messages REST endpoint allows subscriber+ access to privileged integration handlers", "mode": "block", "severity": 8.1, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.25"}, "RULE-CVE-2026-54844-01": {"ajax_action": "checkview_get_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview_get_status AJAX action (CWE-862: Missing Authorization). Patch removes both wp_ajax_nopriv_checkview_get_status and wp_ajax_checkview_get_status hooks entirely.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/checkview/v1/checkview-status(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview/v1/checkview-status REST route (CWE-862: Missing Authorization). Patch adds permission_callback with current_user_can(\'manage_options\') and nonce verification.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:wishlist_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via wishlist_id in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-ajax=premmerce_wishlist_popup~"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in WC AJAX wishlist popup handler", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-5488-01": {"ajax_action": "exactmetrics_ads_get_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_get_token allows subscriber+ role access to Google Ads OAuth token", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5488-02": {"ajax_action": "exactmetrics_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_reset_experience allows subscriber+ role to reset Google Ads experience", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5502-01": {"ajax_action": "tutor_update_course_content_order", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5502", "mode": "block", "severity": 5.3, "slug": "tutor", "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-56006-01": {"ajax_action": "h5p_embed", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56006", "description": "H5P <=1.17.6 unauthenticated reflected XSS via id parameter in h5p_embed AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.6"}, "RULE-CVE-2026-56011-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapp/v1/(?:maps|maps/(?:clone|import))(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/][^>]*on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-56011", "description": "MapPress Maps for WordPress <=2.97.3 unauthenticated stored XSS via REST API map creation/update endpoints", "mode": "block", "severity": 7.1, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.97.3"}, "RULE-CVE-2026-56012-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\b|\\\\bSELECT\\\\s+.*\\\\bFROM\\\\b|/\\\\*[^*]*\\\\*/|information_schema)~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[orderby] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56012-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[s] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56012-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\b|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:--|#))~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[order] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56014-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_params parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_id parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via orderby parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via order parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:post_mime_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via post_mime_type parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:detached", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via detached parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56027-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wcj-my-products~i"}, {"name": "FILES:wcj_add_new_product_image:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-56027", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56027", "description": "Booster for WooCommerce (woocommerce-jetpack) <=8.0.1 authenticated Customer arbitrary file upload via Product by User image field", "mode": "pass", "severity": 9.9, "slug": "woocommerce-jetpack", "tags": ["arbitrary-file-upload", "unrestricted-upload", "authenticated"], "target": "plugin", "versions": "<=8.0.1"}, "RULE-CVE-2026-56028-01": {"ajax_action": "eel_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-56028", "description": "Easy Elements for Elementor <=1.4.9 unauthenticated privilege escalation via role parameter in eel_register AJAX handler", "mode": "block", "severity": 9.8, "slug": "easy-elements", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2026-56030-01": {"ajax_action": "pt_ajax_check_item_limits", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56030", "description": "Paytium <=5.0.2 unauthenticated privilege escalation via pt_ajax_check_item_limits", "mode": "block", "severity": 9.8, "slug": "paytium", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-56036-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via order_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:refund_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via refund_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:payment_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via payment_action parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:_pafw_uid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via _pafw_uid parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56040-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-form/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/].*?on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-56040", "description": "Gutenverse Form <=2.4.7 unauthenticated stored XSS via form submission REST API", "mode": "block", "severity": 7.1, "slug": "gutenverse-form", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-56042-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_mark_exported", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_mark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56042-02": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_unmark_exported", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_unmark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56043-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_submit_review AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56043-02": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_local_forms_submit AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56053-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:(?:\\\\\\"|\\\\{)~"}], "cve": "CVE-2026-56053", "description": "EventPrime <=4.3.4.1 subscriber+ PHP Object Injection via eventprime_api AJAX handler", "mode": "block", "severity": 8.8, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.4.1"}, "RULE-CVE-2026-56054-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:jsst_dir", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:\\\\b|[._])|error_log|debug\\\\.log))~i"}], "cve": "CVE-2026-56054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56054", "description": "JS Help Desk <=3.1.1 subscriber+ arbitrary file/directory deletion via jsticket_ajax AJAX handler (path traversal in jsst_dir)", "mode": "block", "severity": 7.7, "slug": "js-support-ticket", "tags": ["path-traversal", "arbitrary-file-deletion", "missing-authorization"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2026-56060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcdn/v1/(?:settings|dashboard|templates|fonts)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-56060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56060", "description": "Print Invoice & Delivery Notes for WooCommerce <=7.1.1 unauthenticated sensitive data exposure via REST API endpoints (wcdn/v1/settings, dashboard, templates, fonts)", "mode": "block", "severity": 7.5, "slug": "woocommerce-delivery-notes", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-56063-01": {"ajax_action": "mcbSubmit_Form_Data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 unauthenticated broken access control on mcbSubmit_Form_Data AJAX handler", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-02": {"ajax_action": "mcb_get_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcb_get_access_token allows subscriber+ OAuth token retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-03": {"ajax_action": "mcbAudienceList", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbAudienceList allows subscriber+ audience list retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-04": {"ajax_action": "mcbSubmit_Form_AudienceId", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbSubmit_Form_AudienceId allows subscriber+ audience ID modification", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56064-01": {"ajax_action": "tf_booking_calendar_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_calendar_filter AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-02": {"ajax_action": "tf_booking_details_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_details_popup AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-03": {"ajax_action": "tf_order_bulk_action_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_bulk_action_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-04": {"ajax_action": "tf_order_status_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_status_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-05": {"ajax_action": "tf_visitor_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_visitor_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-06": {"ajax_action": "tf_checkinout_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_checkinout_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56070-01": {"ajax_action": "thaps_ajax_get_search_value", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-56070", "description": "Unauthenticated SQL Injection via thaps_ajax_get_search_value AJAX handler in TH Advance Product Search <= 1.4.4", "mode": "block", "severity": 9.3, "slug": "th-advance-product-search", "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2026-56071-01": {"ajax_action": "forminator_submit_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via form submission field values", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-56071-02": {"ajax_action": "forminator_submit_preview_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via preview form submission", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-5710-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:[/?]|$)~"}, {"name": "ARGS:mfile", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2026-5710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5710", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.9.6 unauthenticated path traversal leading to arbitrary file read via mfile[] parameter on CF7 REST feedback endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.9.6"}, "RULE-CVE-2026-5714-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "enable-media-replace/enable-media-replace.php"}, {"name": "ARGS:location_dir", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on[a-z]+=|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-5714", "description": "Enable Media Replace <=4.1.8 authenticated (Author+) stored XSS via location_dir parameter", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "target": "plugin", "versions": "<=4.1.8"}, "RULE-CVE-2026-5722-01": {"ajax_action": "wlfmc_waitlist_signup", "conditions": [{"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist token reuse with email change", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-5722-02": {"action": "init", "conditions": [{"name": "ARGS:waitlist_verify", "type": "equals", "value": "1"}, {"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist verification link token reuse (blocks verification endpoint on vulnerable version; legitimate verification clicks also blocked until patched to 1.9.15)", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "verification-link", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-57317-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~simply-schedule-appointments/booking-app-new/iframe-inner\\\\.php~"}, {"name": "ARGS:token", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?![\\\\s])(?!(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-57317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57317", "description": "Simply Schedule Appointments <=1.6.12.2 unauthenticated reflected XSS via token parameter in booking iframe", "mode": "block", "severity": 7.1, "slug": "simply-schedule-appointments", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=1.6.12.2"}, "RULE-CVE-2026-57319-01": {"ajax_action": "woocs_convert_currency", "conditions": [{"name": "ARGS:precision", "type": "exists"}, {"name": "ARGS:precision", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'precision\' parameter in the woocs_convert_currency AJAX handler (wp_die sink at woocs.php:3728). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57319-02": {"ajax_action": "woocs_rates_current_currency", "conditions": [{"name": "ARGS:exclude", "type": "exists"}, {"name": "ARGS:exclude", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'exclude\' parameter in the woocs_rates_current_currency AJAX handler (wp_die sink at woocs.php:3754). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57321-01": {"ajax_action": "h5p_files", "conditions": [{"name": "ARGS:filePath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57321", "description": "H5P <=1.17.7 contributor+ arbitrary file deletion via path traversal in h5p_files AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.7"}, "RULE-CVE-2026-57631-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popup_category", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popup_category parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popupbox", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popupbox parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57636-01": {"ajax_action": "wpforo_ai_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57636", "description": "wpForo Forum <=3.0.9 contributor+ SQL injection via wpforo_ai_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "wpforo", "target": "plugin", "versions": "<=3.0.9"}, "RULE-CVE-2026-57644-01": {"ajax_action": "mprm_process_checkout", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57644-02": {"ajax_action": "mprm_process_checkout_login", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout_login AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57645-01": {"ajax_action": "newsletters_executemultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_executemultiple AJAX handler allows subscriber+ batch operations", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57645-02": {"ajax_action": "newsletters_exportmultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_exportmultiple AJAX handler allows subscriber+ data export", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57663-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via orderby parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57663-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via order parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57713-01": {"action": "admin_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-57713", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57713", "description": "Events Manager <=7.3.6 PHP Object Injection via unserialize() in multilingual/install data handling (CWE-502)", "mode": "block", "severity": 8.8, "slug": "events-manager", "tags": ["object-injection", "deserialization", "csrf"], "target": "plugin", "versions": "<=7.3.6"}, "RULE-CVE-2026-57724-01": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "update-form-cell"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-57724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57724", "description": "Kirki <=6.0.12 authenticated PHP object injection via update-form-cell request writing to data field later unserialized without allowed_classes restriction", "mode": "block", "severity": 9.8, "slug": "kirki", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57726-01": {"ajax_action": "kirki_wp_admin_get_apis", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "kirki_wp_admin_get_apis"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-57726", "description": "Blocks unauthorized access to Kirki\'s kirki_wp_admin_get_apis AJAX endpoint, which the plugin\'s own code treats as admin-only (nopriv variant dispatches to kirki_wp_admin_unauthorized) but lacked a current_user_can() capability check prior to 6.0.13.", "mode": "block", "slug": "kirki", "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57726-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "kirki_wp_admin_post_apis"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-57726", "description": "Blocks unauthorized access to Kirki\'s kirki_wp_admin_post_apis AJAX endpoint, which the plugin\'s own code treats as admin-only (nopriv variant dispatches to kirki_wp_admin_unauthorized) but lacked a current_user_can() capability check prior to 6.0.13.", "mode": "block", "slug": "kirki", "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57727-01": {"ajax_action": "kirki_get_apis", "conditions": [{"name": "ARGS:/post_id|session_id|term_id/", "type": "exists"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-57727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57727", "description": "Kirki <=6.0.13 missing authorization on kirki_get_apis AJAX handler allows unauthenticated IDOR access via post_id/session_id/term_id", "mode": "block", "severity": 7.5, "slug": "kirki", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.0.13"}, "RULE-CVE-2026-57728-01": {"action": "wp_footer", "conditions": [{"name": "ARGS:block", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-57728", "description": "Flatsome theme <=3.20.5 unauthenticated reflected XSS via block parameter in ux_block_frontend()", "mode": "block", "severity": 7.1, "slug": "flatsome", "target": "theme", "versions": "<=3.20.5"}, "RULE-CVE-2026-57737-01": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:ID", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via ID parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-02": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via type parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-03": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:tmpl", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via tmpl parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-04": {"ajax_action": "auxin_templates_data", "conditions": [{"name": "ARGS:title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via title parameter in auxin_templates_data AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-05": {"ajax_action": "aux_ajax_lightbox", "conditions": [{"name": "ARGS:preview", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 reflected XSS via preview parameter in aux_ajax_lightbox AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57737-06": {"ajax_action": "aux_the_recent_products", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:(?=\\\\S)|<img\\\\b[^>]+\\\\bonerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-57737", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57737", "description": "Shortcodes and extra features for Phlox theme <=2.17.16 unauthenticated reflected XSS via data parameter in aux_the_recent_products AJAX handler", "mode": "block", "severity": 6.5, "slug": "auxin-elements", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.17.16"}, "RULE-CVE-2026-57773-01": {"ajax_action": "wc_ast_upload_csv_form_update", "conditions": [{"name": "ARGS:tracking_provider", "type": "regex", "value": "~(?:\'\\\\s*(?:OR|AND)\\\\s|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|--\\\\s|#|/\\\\*)~i"}], "cve": "CVE-2026-57773", "description": "Advanced Shipment Tracking for WooCommerce <=4.0 authenticated (Shop Manager+) blind SQL injection via tracking_provider parameter in CSV import AJAX handler", "mode": "block", "slug": "woo-advanced-shipment-tracking", "target": "plugin", "versions": "<=4.0"}, "RULE-CVE-2026-57813-01": {"ajax_action": "mailoptin_connect_process", "conditions": [{"name": "", "type": "missing_capability", "value": "administrator"}], "cve": "CVE-2026-57813", "description": "MailOptin <=1.2.77.3 unauthenticated privilege escalation via mailoptin_connect_process AJAX handler (removed wp_ajax_nopriv exposure, missing capability check)", "mode": "block", "severity": 9.8, "slug": "mailoptin", "target": "plugin", "versions": "<=1.2.77.3"}, "RULE-CVE-2026-57813-02": {"action": "admin_post_mailoptin_upgrader", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57813", "description": "MailOptin <=1.2.77.3 missing authorization on admin_post_mailoptin_upgrader allows unauthorized upgrade/install action", "mode": "block", "severity": 9.8, "slug": "mailoptin", "target": "plugin", "versions": "<=1.2.77.3"}, "RULE-CVE-2026-5809-01": {"ajax_action": "wpforo_ai_wp_get_post_types", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_get_post_types AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-02": {"ajax_action": "wpforo_ai_wp_get_taxonomies", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomies AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-03": {"ajax_action": "wpforo_ai_wp_get_taxonomy_terms", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomy_terms AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-04": {"ajax_action": "wpforo_ai_wp_index_by_taxonomy", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_index_by_taxonomy AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-05": {"ajax_action": "wpforo_ai_wp_index_custom", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_index_custom AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5821-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metakeyinput", "type": "equals", "value": "image_optimizer_metadata"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~s:7:\\"backups\\";a:[0-9]+:{~i"}], "cve": "CVE-2026-5821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5821", "description": "Image Optimizer <=1.7.4 arbitrary file deletion via untrusted absolute paths injected into image_optimizer_metadata post meta backups array", "mode": "pass", "severity": 8.1, "slug": "image-optimization", "tags": ["arbitrary-file-deletion", "insufficient-path-validation", "authenticated"], "target": "plugin", "versions": "<=1.7.4"}, "RULE-CVE-2026-59525-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS:search_field", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9a-zA-Z\'\\"]+\\\\s*=\\\\s*[0-9a-zA-Z\'\\"]+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|/\\\\*.*?\\\\*/|--\\\\s|#\\\\s)~i"}], "cve": "CVE-2026-59525", "description": "Participants Database <=2.7.8.3 unauthenticated SQL injection via search_field in pdb_list_filter AJAX handler", "mode": "block", "severity": 9.3, "slug": "participants-database", "target": "plugin", "versions": "<=2.7.8.3"}, "RULE-CVE-2026-59530-01": {"ajax_action": "wc_stripe_admin_request", "conditions": [{"name": "ARGS:path", "type": "exists"}, {"name": "ARGS:path", "type": "regex", "value": "~^/?(?:wp/v2/(?:users|settings|plugins|themes|application-passwords|options)|wc/v3(?:/|$)|wc-admin|wc-analytics|jwt-auth)~i"}], "cve": "CVE-2026-59530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-59530", "description": "Stripe For WooCommerce (woo-stripe-payment) <=4.0.7 broken access control via wc_stripe_admin_request AJAX-to-REST dispatch bridge allowing pivot to sensitive REST namespaces", "mode": "block", "severity": 7.5, "slug": "woo-stripe-payment", "tags": ["missing-authorization", "broken-access-control", "rest-api-pivot"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2026-59549-01": {"ajax_action": "rtmedia_rt_album_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-59549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-59549", "description": "rtMedia for WordPress, BuddyPress and bbPress <=4.7.10 missing authorization on BuddyPress album import AJAX handler (rtmedia_rt_album_import), hardened in the same 4.7.11 release that addresses CVE-2026-59549", "mode": "block", "severity": 9.3, "slug": "buddypress-media", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=4.7.10"}, "RULE-CVE-2026-59558-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "wpbc-settings"}, {"name": "ARGS:form_visible_section", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-59558", "description": "Booking Calendar <=11.4.3 reflected XSS via form_visible_section parameter on wpbc-settings admin page", "mode": "block", "severity": 7.1, "slug": "booking", "target": "plugin", "versions": "<=11.4.3"}, "RULE-CVE-2026-5957-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/emailkit/v1/create[_-]template(?:/|\\\\?|&|$)~"}, {"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 authenticated arbitrary file read via REST create_template emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-03": {"ajax_action": "emailkit_admin_action", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_admin_action AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-04": {"ajax_action": "emailkit_filter_save_as_template", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_filter_save_as_template AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-60137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-03": {"action": "init", "conditions": [{"name": "ARGS:/^author_exclude$|^author__not_in$/", "type": "detectSQLi"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress Core SQL injection via author__not_in / REST author_exclude in WP_Query (wp2shell SQLi primitive) - standalone/plugin-mediated parameter and WP 6.8.x coverage not addressed by the batch-scoped rules -01/-02.", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "unauthenticated", "wp-core", "wp2shell", "defense-in-depth"], "target": "core", "versions": ">=6.8.0 <6.8.6 || >=6.9.0 <6.9.5 || >=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-05": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6101-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "amp_settings"}, {"name": "ARGS:ampforwp-local-font-zip", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]|%2[Ee]{1,2}%2[Ee]{0,1}[/\\\\\\\\%]|%252[Ee]%252[Ee]%25(?:2[Ff]|5[Cc]))~i"}], "cve": "CVE-2026-6101", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6101", "description": "AMP for WP <=1.1.12 authenticated Author+ arbitrary file write via ZIP-slip path traversal in ampforwp_save_local_font local font upload", "mode": "block", "severity": 7.5, "slug": "accelerated-mobile-pages", "tags": ["arbitrary-file-write", "path-traversal", "zip-slip", "authenticated"], "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2026-61949-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:import", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|/\\\\*.*?\\\\*/|--\\\\s|#\\\\s|`[^`]*`\\\\s*(?:=|,)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-61949", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61949", "description": "Bookly <=27.7 unauthenticated SQL injection via import parameter reaching $wpdb->query in diagnostics AJAX handler", "mode": "block", "severity": 9.3, "slug": "bookly-responsive-appointment-booking-tool", "tags": ["sql-injection", "unauthenticated", "diagnostics"], "target": "plugin", "versions": "<=27.7"}, "RULE-CVE-2026-61961-01": {"ajax_action": "fetch_video_description", "conditions": [{"name": "ARGS:vid", "type": "regex", "value": "~(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<svg[^>]*>|<img[^>]*>|\\"\\\\s*>|\'\\\\s*>)~i"}], "cve": "CVE-2026-61961", "description": "EmbedPress <=4.5.6 unauthenticated reflected XSS via vid parameter in fetch_video_description AJAX handler", "mode": "block", "slug": "embedpress", "target": "plugin", "versions": "<=4.5.6"}, "RULE-CVE-2026-61964-01": {"ajax_action": "ninja_tables_dt_public", "conditions": [{"name": "ARGS:/table_id|draw|start|length/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|[\\"\'<>])~i"}], "cve": "CVE-2026-61964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61964", "description": "Ninja Tables <=5.2.9 unauthenticated reflected XSS via table_id/draw/start/length parameters on ninja_tables_dt_public AJAX handler", "mode": "block", "severity": 7.1, "slug": "ninja-tables", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=5.2.9"}, "RULE-CVE-2026-61967-01": {"ajax_action": "mo_osp_check_blocked", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-61967", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61967", "description": "miniOrange OTP Verification <=5.5.1 unauthenticated privilege escalation via missing authorization on OTP Spam Preventer mo_osp_check_blocked AJAX handler", "mode": "block", "severity": 9.8, "slug": "miniorange-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2026-61967-02": {"ajax_action": "mo_osp_unblock_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-61967", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-61967", "description": "miniOrange OTP Verification <=5.5.1 unauthenticated privilege escalation via missing authorization on OTP Spam Preventer mo_osp_unblock_user AJAX handler", "mode": "block", "severity": 9.8, "slug": "miniorange-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=5.5.1"}, "RULE-CVE-2026-61979-01": {"action": "init", "conditions": [{"name": "ARGS:SAMLResponse", "type": "regex", "value": "~(?:a[^A-Za-z0-9+/=]*G[^A-Za-z0-9+/=]*1[^A-Za-z0-9+/=]*h[^A-Za-z0-9+/=]*Y[^A-Za-z0-9+/=]*y[^A-Za-z0-9+/=]*1[^A-Za-z0-9+/=]*z[^A-Za-z0-9+/=]*a[^A-Za-z0-9+/=]*G[^A-Za-z0-9+/=]*E[^A-Za-z0-9+/=]*x|h[^A-Za-z0-9+/=]*t[^A-Za-z0-9+/=]*Y[^A-Za-z0-9+/=]*W[^A-Za-z0-9+/=]*M[^A-Za-z0-9+/=]*t[^A-Za-z0-9+/=]*c[^A-Za-z0-9+/=]*2[^A-Za-z0-9+/=]*h[^A-Za-z0-9+/=]*h[^A-Za-z0-9+/=]*M|o[^A-Za-z0-9+/=]*b[^A-Za-z0-9+/=]*W[^A-Za-z0-9+/=]*F[^A-Za-z0-9+/=]*j[^A-Za-z0-9+/=]*L[^A-Za-z0-9+/=]*X[^A-Za-z0-9+/=]*N[^A-Za-z0-9+/=]*o[^A-Za-z0-9+/=]*Y[^A-Za-z0-9+/=]*T)~"}], "cve": "CVE-2026-61979", "cve_link": "https://www.cve.org/CVERecord?id=CVE-2026-61979", "description": "miniOrange SAML SSO accepts an HMAC-SHA1 SignatureMethod and verifies it with the IdP public certificate as the shared secret, letting anyone forge a signed SAMLResponse", "method": "POST", "mode": "block", "severity": 8.1, "slug": "miniorange-saml-20-single-sign-on", "tags": ["authentication-bypass", "privilege-escalation", "saml", "signature-forgery", "unauthenticated", "actively-exploited"], "target": "plugin", "versions": "<=5.4.3"}, "RULE-CVE-2026-61982-01": {"action": "init", "conditions": [{"name": "ARGS:redirect_to", "type": "regex", "value": "~(?:[\\"\'<>]|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-61982", "description": "SiteGuard <=1.8.6 unauthenticated reflected XSS via redirect_to parameter reaching filter_logout_url href output", "mode": "block", "slug": "siteguard", "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2026-6203-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "logout"}, {"name": "ARGS:redirect_to_on_logout", "type": "regex", "value": "~^\\\\s*(?:(?:https?:)?//|[a-zA-Z][a-zA-Z0-9+.-]*:)~i"}], "cve": "CVE-2026-6203", "description": "User Registration <=5.1.4 unauthenticated open redirect via redirect_to_on_logout parameter on wp-login.php logout", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-62062-01": {"action": "admin_post_elementor_site_clear_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-62062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62062", "description": "Elementor Website Builder <=4.3.1 CSRF via admin_post_elementor_site_clear_cache missing capability check on cache-clearing action", "mode": "block", "severity": 8.8, "slug": "elementor", "tags": ["csrf", "missing-authorization", "state-change", "authenticated"], "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2026-62103-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^everest_forms_~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:[OC]:[0-9]+:\\"[^\\"]*\\":[0-9]+:\\\\{|a:[0-9]+:\\\\{)~"}], "cve": "CVE-2026-62103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62103", "description": "Everest Forms <=3.6.0 unauthenticated PHP object injection via serialized upload field value processed by html_field_value()", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.6.0"}, "RULE-CVE-2026-62107-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-62107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62107", "description": "Masteriyo LMS <=3.4.0 unauthenticated PHP object injection via serialized payload reaching unhardened maybe_unserialize reads in certificate, course-announcement, google-meet, group-courses, and wishlist repository metadata hydration (write-side entrypoint not resolved in current evidence; generic serialized-object-header detection applied as defense-in-depth)", "mode": "block", "severity": 8.8, "slug": "learning-management-system", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2026-6227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/getblock(?:[/?&]|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:(?:(?:\\\\.\\\\.|%2e%2e)[\\\\\\\\/]|(?:\\\\.\\\\.|%2e%2e)(?:%2f|%5c)){2,}|(?:\\\\.{4,}[\\\\\\\\/]{1,}){2,}|%252e%252e(?:%252f|%255c|%2f|%5c|/|\\\\\\\\))~i"}], "cve": "CVE-2026-6227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6227", "description": "BackWPup <=5.6.6 authenticated local file inclusion via block_name parameter in /backwpup/v1/getblock REST endpoint", "mode": "block", "severity": 7.2, "slug": "backwpup", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.6"}, "RULE-CVE-2026-6229-01": {"action": "init", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via Data Table widget CSV URL parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6229-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via url parameter in Data Table CSV fetch", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6235-01": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apikey", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via manage_admin_requests", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6235-02": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apisecret", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via sm_apisecret", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (admin-post.php)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6248-02": {"action": "init", "conditions": [{"name": "ARGS:wpforo", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (front-end profile update)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6275-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:</script|<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|input|blur)\\\\s*=|javascript\\\\s*:|\\"\\\\s*;)~i"}], "cve": "CVE-2026-6275", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6275", "description": "StatCounter <=2.1.1 Author+ stored XSS via nickname field echoed unescaped into JavaScript context by statcounter_addToTags()", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-63030-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-63030-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6320-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-6320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6320", "description": "Salon Booking System <=10.30.25 unauthenticated arbitrary file read via booking attachment file field path traversal", "mode": "block", "severity": 7.5, "slug": "salon-booking-system", "tags": ["arbitrary-file-read", "path-traversal", "unauthenticated", "file-inclusion"], "target": "plugin", "versions": "<=10.30.25"}, "RULE-CVE-2026-6372-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~^WC_Gateway_Plisio$~i"}, {"name": "ARGS:status", "type": "regex", "value": "~^(?:completed|mismatch|expired|cancelled)$~i"}], "cve": "CVE-2026-6372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6372", "description": "Accept Cryptocurrencies with Plisio <=2.0.5 unauthenticated payment bypass via forged wc-api callback", "mode": "block", "severity": 7.5, "slug": "plisio-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "payment-bypass", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-6403-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/v1/blueprint/[^/?]+(?:[/?]|$)~"}, {"name": "ARGS:stylesheet", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[a-z]:[/\\\\\\\\]|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-6403", "description": "Quick Playground <=1.3.3 unauthenticated path traversal via stylesheet parameter in blueprint REST endpoint", "mode": "block", "severity": 7.5, "slug": "quick-playground", "target": "plugin", "versions": "<=1.3.3"}, "RULE-CVE-2026-6427-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<video[^>]*(?:on(?:focus|error|load|mouseover|click|mouseenter)\\\\s*=|autofocus[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6427", "description": "a3 Lazy Load <=2.7.6 contributor+ stored XSS via crafted video element in post content (post editor)", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-6427-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<video[^>]*(?:on(?:focus|error|load|mouseover|click|mouseenter)\\\\s*=|autofocus[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6427", "description": "a3 Lazy Load <=2.7.6 contributor+ stored XSS via crafted video element in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-6431-01": {"action": "init", "conditions": [{"name": "ARGS:description", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<svg[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-6431", "description": "Profile Builder <=3.15.7 unauthenticated stored XSS via Biographical Info \'description\' field on front-end registration/edit-profile forms", "mode": "block", "slug": "profile-builder", "target": "plugin", "versions": "<=3.15.7"}, "RULE-CVE-2026-6456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/account-switcher/v1/remember-login(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6456", "description": "Account Switcher <=1.0.2 privilege escalation via rememberLogin REST endpoint loose comparison", "mode": "block", "severity": 8.8, "slug": "account-switcher", "tags": ["authentication-bypass", "privilege-escalation", "rest-api", "unauthenticated-from-subscriber"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-64638-01": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through the wp-login.php username or email field", "method": "POST", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-64638-02": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:X-HTTP-Method-Override", "type": "regex", "value": "~^(?:GET|PUT|PATCH|DELETE)$~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through wp-login.php with an HTTP method-override header", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-64638-03": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "ARGS:/^_method$/", "type": "regex", "value": "~^(?:GET|PUT|PATCH|DELETE)$~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through wp-login.php with a form method override", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-6495-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_container_type", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_container_type", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_color", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_color", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_custom_js", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_custom_js", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_default_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_default_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-theme-templates~"}, {"name": "ARGS:alm_theme_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_theme_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-licenses~"}, {"name": "ARGS:alm_license_key", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_license_key", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_preview", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_preview", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-65048-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-65048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65048", "description": "Ninja Forms >=3.10.4 <3.14.9 unauthenticated stored XSS via crafted repeater submission index in nf_ajax_submit formData", "mode": "block", "severity": 9.3, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "unauthenticated", "form-submission"], "target": "plugin", "versions": ">=3.10.4 <3.14.9"}, "RULE-CVE-2026-65048-02": {"ajax_action": "nf_ajax_resume", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]*\\\\bon[a-z]{3,20}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-65048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65048", "description": "Ninja Forms >=3.10.4 <3.14.9 unauthenticated stored XSS via crafted repeater submission index in nf_ajax_resume formData", "mode": "block", "severity": 9.3, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "unauthenticated", "form-submission"], "target": "plugin", "versions": ">=3.10.4 <3.14.9"}, "RULE-CVE-2026-65050-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_ID", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~ninja-forms/submissions-table~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-65050", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65050", "description": "Ninja Forms <=3.14.8 missing authorization allows Author-level users to embed the ninja-forms/submissions-table block with an arbitrary formID via post save, exposing signed bearer tokens to unauthenticated visitors", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2026-65051-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\"type\\"\\\\s*:\\\\s*\\"[a-z_]+\\".{0,200}\\"(?:required|settings)\\"\\\\s*:~is"}], "cve": "CVE-2026-65051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65051", "description": "Ninja Forms <3.14.9 unauthenticated server-side validation bypass via client-controlled field metadata (type/required/settings) merge in nf_ajax_submit AJAX handler", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["client-side-enforcement", "validation-bypass", "unauthenticated"], "target": "plugin", "versions": "<3.14.9"}, "RULE-CVE-2026-65051-02": {"ajax_action": "nf_ajax_resume", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\"type\\"\\\\s*:\\\\s*\\"[a-z_]+\\".{0,200}\\"(?:required|settings)\\"\\\\s*:~is"}], "cve": "CVE-2026-65051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65051", "description": "Ninja Forms <3.14.9 unauthenticated server-side validation bypass via client-controlled field metadata (type/required/settings) merge in nf_ajax_resume AJAX handler", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["client-side-enforcement", "validation-bypass", "unauthenticated"], "target": "plugin", "versions": "<3.14.9"}, "RULE-CVE-2026-6518-01": {"ajax_action": "cmp_theme_update_install", "conditions": [{"name": "ARGS:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6518", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6518", "description": "CMP Coming Soon & Maintenance <=4.1.16 authenticated arbitrary file upload via cmp_theme_update_install AJAX action", "mode": "block", "severity": 8.8, "slug": "cmp-coming-soon-maintenance", "tags": ["arbitrary-file-upload", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2026-65437-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~i"}, {"name": "ARGS:m", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img[^>]*onerror)~i"}], "cve": "CVE-2026-65437", "description": "Spam protection, AntiSpam, FireWall by CleanTalk <=6.82 unauthenticated reflected XSS via \'m\' parameter in CleantalkListTable::months_dropdown printf sink", "mode": "block", "slug": "cleantalk-spam-protect", "target": "plugin", "versions": "<=6.82"}, "RULE-CVE-2026-65439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Aa]%61%76%61%73%63%72%69%70%74)~i"}], "cve": "CVE-2026-65439", "description": "Ultimate Addons for Contact Form 7 <=3.5.45 reflected XSS via unescaped REQUEST_URI echoed by dynamic-text current-url shortcode", "mode": "block", "severity": 7.1, "slug": "ultimate-addons-for-contact-form-7", "target": "plugin", "versions": "<=3.5.45"}, "RULE-CVE-2026-65509-01": {"ajax_action": "wpdatatables_get_columns_data_by_table_id", "conditions": [{"name": "ARGS:table_id", "type": "regex", "value": "~^(?!^[0-9]+$).+$~"}], "cve": "CVE-2026-65509", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65509", "description": "wpDataTables <7.5.2 reflected XSS via unescaped table_id echoed by wpdatatables_get_columns_data_by_table_id AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpdatatables", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<7.5.2"}, "RULE-CVE-2026-65640-01": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core async-upload multipart field whose inspected bytes start with a plain PostScript resource header", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-02": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core REST multipart file field whose inspected bytes start with a plain PostScript resource header", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-03": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~application/pdf.*(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core async-upload multipart field carrying visible PDF cover metadata followed by a plain PostScript signature in the inspected prefix", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "audio-cover", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-04": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~application/pdf.*(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core REST multipart file field carrying visible PDF cover metadata followed by a plain PostScript signature in the inspected prefix", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "audio-cover", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-05": {"action": "init", "conditions": [{"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:dps|epi|eps[23fi]?|ept[23]?|ps[23]?|wpg)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PostScript-family upload extension on the WordPress async-upload multipart field, which selects the Imagick PostScript coder and reaches Ghostscript without needing a visible signature", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "postscript-extension"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-06": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:dps|epi|eps[23fi]?|ept[23]?|ps[23]?|wpg)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PostScript-family upload extension on a multipart file field on requests reaching rest_api_init, which selects the Imagick PostScript coder and reaches Ghostscript without needing a visible signature", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "postscript-extension"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-07": {"action": "init", "conditions": [{"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?!%PDF-)~"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~%pipe%|/OutputFile|putdeviceprops|\\\\.forceput|\\\\.libfile|\\\\.tempfile|\\\\.rsdparams|\\\\.setglobal|\\\\.actonuserparams|\\\\.bindnow|deletefile|renamefile~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PDF-family upload on the WordPress async-upload multipart field that lacks the %PDF- signature yet carries a PostScript signature later in the inspected prefix, the pdf_load_source Ghostscript path", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "pdf-signature-mismatch"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-08": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?!%PDF-)~"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}, {"name": "FILES:file:content", "type": "regex", "value": "~%pipe%|/OutputFile|putdeviceprops|\\\\.forceput|\\\\.libfile|\\\\.tempfile|\\\\.rsdparams|\\\\.setglobal|\\\\.actonuserparams|\\\\.bindnow|deletefile|renamefile~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core PDF-family upload on a multipart file field on requests reaching rest_api_init that lacks the %PDF- signature yet carries a PostScript signature later in the inspected prefix, the pdf_load_source Ghostscript path", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "pdf-signature-mismatch"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-09": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?:\\\\x1F\\\\x8B\\\\x08|BZh|\\\\x1F\\\\x9D)~s"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.(?:jpe?g|jpe|png|gif|bmp|tiff?|webp|avif|ico|heic|heif|heics|heifs|ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core compressed payload wearing an image or PDF extension on the WordPress async-upload multipart field, which Imagick transparently decompresses before deciding the format", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "compressed-wrapper"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-10": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?:\\\\x1F\\\\x8B\\\\x08|BZh|\\\\x1F\\\\x9D)~s"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:jpe?g|jpe|png|gif|bmp|tiff?|webp|avif|ico|heic|heif|heics|heifs|ai|epdf|pdf|pdfa|pocketmod)\\\\s*\\\\z~i"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core compressed payload wearing an image or PDF extension on a multipart file field on requests reaching rest_api_init, which Imagick transparently decompresses before deciding the format", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "wp-core", "postscript", "compressed-wrapper"], "target": "core", "versions": "<4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-66424-01": {"ajax_action": "activate_pending_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on activate_pending_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66424-02": {"ajax_action": "reject_pending_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on reject_pending_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66424-03": {"ajax_action": "wcmp_suspend_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on wcmp_suspend_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66424-04": {"ajax_action": "wcmp_activate_vendor", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66424", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66424", "description": "SMS Alert Order Notifications <=3.9.7 missing authorization on wcmp_activate_vendor AJAX action allows privilege escalation", "mode": "block", "severity": 9.8, "slug": "sms-alert", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-66439-01": {"ajax_action": "berocket_aapf_color_listener", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66439", "description": "WooCommerce Ajax Product Filters (BeRocket) <=3.2.0.3 reflected XSS via br_product_filter/type parameters in berocket_aapf_color_listener AJAX handler", "mode": "block", "slug": "woocommerce-ajax-filters", "target": "plugin", "versions": "<=3.2.0.3"}, "RULE-CVE-2026-66439-02": {"ajax_action": "br_include_exclude_list", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66439", "description": "WooCommerce Ajax Product Filters (BeRocket) <=3.2.0.3 reflected XSS via br_product_filter parameter in br_include_exclude_list AJAX handler", "mode": "block", "slug": "woocommerce-ajax-filters", "target": "plugin", "versions": "<=3.2.0.3"}, "RULE-CVE-2026-66446-01": {"ajax_action": "ifso_analytics_req", "conditions": [{"name": "ARGS:an_action", "type": "regex", "value": "~^(?:getTriggerReport|resetFields|resetAllAnalytics)$~i"}, {"type": "missing_capability", "value": "administrator"}, {"type": "missing_capability", "value": "editor"}], "cve": "CVE-2026-66446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66446", "description": "If-So Dynamic Content Personalization <1.10.0.1 authorization bypass in ifso_analytics_req AJAX handler (handle()) allows subscriber-level access to administrative report/reset actions (getTriggerReport, resetFields, resetAllAnalytics) that feed SQL injection in records-service queries", "mode": "block", "severity": 9.3, "slug": "if-so", "tags": ["sql-injection", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.10.0.1"}, "RULE-CVE-2026-66457-01": {"ajax_action": "search_events_grouped", "conditions": [{"name": "ARGS:header_format", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66457", "description": "Events Manager <=7.4.1 unauthenticated reflected XSS via header_format parameter in grouped event list AJAX search", "mode": "block", "slug": "events-manager", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2026-66457-02": {"ajax_action": "search_events_grouped", "conditions": [{"name": "ARGS:date_format", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-66457", "description": "Events Manager <=7.4.1 unauthenticated reflected XSS via date_format parameter in grouped event list AJAX search", "mode": "block", "slug": "events-manager", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2026-66574-01": {"action": "init", "conditions": [{"name": "ARGS:/title_tag|title_tags|sub_title_size|title_size/", "type": "regex", "value": "~[\\"\'<>\\\\s]|on\\\\w+\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-66574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66574", "description": "Element Pack Elementor Addons <=8.8.3 Contributor stored XSS via unsanitized dynamic HTML tag settings (title_tag, title_tags, sub_title_size, title_size) in animated-card, custom-gallery, and fancy-list widgets", "mode": "block", "severity": 6.5, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored", "contributor", "elementor-widget"], "target": "plugin", "versions": "<=8.8.3"}, "RULE-CVE-2026-66583-01": {"action": "init", "conditions": [{"name": "ARGS:form_uid", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]*\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-66583", "description": "Forminator <=1.57.0.5 unauthenticated PHP Object Injection via form_uid parameter", "mode": "block", "severity": 9.8, "slug": "forminator", "target": "plugin", "versions": "<=1.57.0.5"}, "RULE-CVE-2026-66602-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^csf_.*_ajax_save$~"}, {"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66602", "description": "HashBar - WordPress Notification Bar <=2.0.0 CSRF via unprotected Codestar admin options ajax_save handler", "mode": "block", "severity": 8.8, "slug": "hashbar-wp-notification-bar", "tags": ["csrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-66608-01": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-66608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66608", "description": "Unlimited Elements For Elementor <=2.0.19 Contributor-level SSRF exposure via unauthorized elementor_integrate template import AJAX action", "mode": "block", "severity": 6.4, "slug": "unlimited-elements-for-elementor", "tags": ["ssrf", "authenticated", "missing-authorization", "elementor"], "target": "plugin", "versions": "<=2.0.19"}, "RULE-CVE-2026-66608-02": {"ajax_action": "unitecreator_elementor_export_template", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-66608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66608", "description": "Unlimited Elements For Elementor <=2.0.19 Contributor-level SSRF exposure via unauthorized elementor_integrate template export AJAX action", "mode": "block", "severity": 6.4, "slug": "unlimited-elements-for-elementor", "tags": ["ssrf", "authenticated", "missing-authorization", "elementor"], "target": "plugin", "versions": "<=2.0.19"}, "RULE-CVE-2026-66618-01": {"action": "init", "conditions": [{"name": "ARGS:map_locations[/[0-9]+/]", "type": "regex", "value": "~^(?![0-9]+$).+$~"}], "cve": "CVE-2026-66618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66618", "description": "WP Maps (wp-google-map-plugin) <5.0.0 administrator SQL injection via non-numeric map_locations array values reaching the shared IN() query builder", "mode": "block", "severity": 7.6, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "administrator", "authenticated"], "target": "plugin", "versions": "<5.0.0"}, "RULE-CVE-2026-66618-02": {"action": "init", "conditions": [{"name": "ARGS:map_locations", "type": "regex", "value": "~^(?![0-9]+$).+$~"}], "cve": "CVE-2026-66618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66618", "description": "WP Maps (wp-google-map-plugin) <5.0.0 administrator SQL injection via non-numeric map_locations scalar value reaching the shared IN() query builder", "mode": "block", "severity": 7.6, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "administrator", "authenticated"], "target": "plugin", "versions": "<5.0.0"}, "RULE-CVE-2026-66659-01": {"ajax_action": "get_redirection_data", "conditions": [{"name": "ARGS:redirect_token", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|[\'\\"]\\\\s*(?:OR|AND)\\\\s|--\\\\s|/\\\\*.*?\\\\*/)~i"}], "cve": "CVE-2026-66659", "description": "Tablesome Table <=1.2.9 unauthenticated blind SQL injection via redirect_token parameter in get_redirection_data AJAX action", "mode": "block", "slug": "tablesome", "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2026-66667-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-66667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66667", "description": "Templately <=3.7.1 missing authorization on templately_pack_* full-site/template pack import AJAX handler enabling unauthenticated stored XSS via unsanitized custom CSS option", "mode": "block", "severity": 7.1, "slug": "templately", "tags": ["missing-authorization", "stored-xss", "template-import"], "target": "plugin", "versions": "<=3.7.1"}, "RULE-CVE-2026-66708-01": {"ajax_action": "boldgrid_transfer_resync_database", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-66708", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66708", "description": "Total Upkeep (boldgrid-backup) <1.17.3 missing authorization on boldgrid_transfer_resync_database AJAX handler allows any authenticated user to trigger database resync file read/write/delete", "mode": "block", "severity": 8.2, "slug": "boldgrid-backup", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.17.3"}, "RULE-CVE-2026-6690-01": {"ajax_action": "lp_update_mds", "conditions": [{"name": "ARGS:n", "type": "regex", "value": "~(?:<script[\\\\s/>]|on[a-z]+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-6690", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6690", "description": "LifePress <=2.2.2 unauthenticated stored XSS via lp_update_mds AJAX action", "mode": "block", "severity": 7.2, "slug": "lifepress", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2026-6741-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:wp_user_id", "type": "exists"}, {"name": "ARGS:customer_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6741", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6741", "description": "LatePoint <=5.4.1 privilege escalation via unauthorized customer-to-WordPress-user account linking in latepoint_route_call AJAX action", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "missing-authorization", "account-takeover"], "target": "plugin", "versions": "<=5.4.1"}, "RULE-CVE-2026-6817-01": {"ajax_action": "ays_rate_the_quiz", "conditions": [{"name": "ARGS:rate_reason", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|pointermove|pointerenter|pointerleave|pointercancel|gotpointercapture|lostpointercapture|wheel|contextmenu|copy|cut|paste|drag|dragstart|dragend|dragenter|dragleave|dragover|drop|input|change|select|submit|reset|keydown|keyup|keypress|touchstart|touchend|touchmove|touchcancel|abort|beforeunload|hashchange|message|offline|online|pagehide|pageshow|popstate|resize|storage|unload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=|&#x?0*(?:3c|60)\\\\s*;\\\\s*script)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS via rate_reason parameter in ays_rate_the_quiz AJAX action", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6817-02": {"ajax_action": "ays_load_more_reviews", "conditions": [{"name": "ARGS:start_from", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS render path via ays_load_more_reviews start_from parameter", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6828-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]+\\\\bonerror\\\\b|<svg[\\\\s/][^>]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (post.php)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6828-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]+\\\\bonerror\\\\b|<svg[\\\\s/][^>]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6916-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~sg_content_number_prefix[\\"\'\\\\\\\\]*\\\\s*:\\\\s*[\\"\'\\\\\\\\]*[^\\"\'}]*(?:[^\\"\'}]|\')*(?:<[a-zA-Z!/]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&#x?[0-9a-f]+;?<|%3C(?:script|img|svg|iframe))~i"}], "cve": "CVE-2026-6916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6916", "description": "Jeg Elementor Kit >=3.0.0 <=3.1.0 contributor+ stored XSS via Fun Fact widget sg_content_number_prefix setting", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": ">=3.0.0 <=3.1.0"}, "RULE-CVE-2026-6933-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "create_plugin"}, {"name": "ARGS:premmerce_plugin_namespace", "type": "regex", "value": "~[;{}()$`]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|eval|assert|phpinfo|file_put_contents|file_get_contents|base64_decode|unlink)\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 authenticated RCE via unsanitized namespace injection in plugin generator", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "generate_data"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on generate_data admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "clean_up"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on clean_up admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6963-01": {"ajax_action": "wmg_save_provider_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_save_provider_config allows subscriber+ privilege escalation", "mode": "block", "severity": 9.8, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-02": {"ajax_action": "wmg_get_saved_configs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_get_saved_configs allows subscriber+ data disclosure", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-03": {"ajax_action": "wmg_test_provider_config_send_mail", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_test_provider_config_send_mail allows subscriber+ email sending", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "email-abuse"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-7048-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post content", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7048-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post_content parameter", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7106-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:hscrm_user_roles", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-7106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7106", "description": "Highland Software Custom Role Manager <=1.0.0 authenticated privilege escalation via hscrm_user_roles[] on personal_options_update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "highland-software-custom-role-manager", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-7252-01": {"ajax_action": "updraft_smush_ajax", "conditions": [{"name": "ARGS:do", "type": "equals", "value": "unscheduled_original_file_deletion"}, {"name": "ARGS:attachment_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-7252", "mode": "block", "severity": 8.1, "slug": "wp-optimize", "target": "plugin", "versions": "<=4.5.2"}, "RULE-CVE-2026-73187-01": {"ajax_action": "scw_save_form_data", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~scw_form_fields\\\\[[^\\\\]]*(?:[`\'\\";)(]|--|#|/\\\\*|UNION\\\\s+SELECT)~i"}], "cve": "CVE-2026-73187", "description": "Sticky Chat Widget <=1.4.2 unauthenticated SQL injection via attacker-controlled scw_form_fields array keys in scw_save_form_data AJAX handler", "mode": "block", "severity": 9.3, "slug": "sticky-chat-widget", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-7330-01": {"ajax_action": "aal_stats_save", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseout|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-7330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7330", "description": "WP Auto Affiliate Links <=6.8.8 unauthenticated stored XSS via url parameter", "mode": "block", "severity": 7.2, "slug": "wp-auto-affiliate-links", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=6.8.8"}, "RULE-CVE-2026-73341-01": {"ajax_action": "rm_activate_user", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-73341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73341", "description": "RegistrationMagic (Custom Registration Form Builder with Submission Manager) <=6.0.9.7 unauthenticated PHP object injection via rm_activate_user AJAX action", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=6.0.9.7"}, "RULE-CVE-2026-73341-02": {"ajax_action": "rm_login_social_user", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-73341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73341", "description": "RegistrationMagic (Custom Registration Form Builder with Submission Manager) <=6.0.9.7 unauthenticated PHP object injection via rm_login_social_user AJAX action", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=6.0.9.7"}, "RULE-CVE-2026-73343-01": {"ajax_action": "wpc_v2_lazy_patch_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated settings write via wpc_v2_lazy_patch_setting AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73343-02": {"ajax_action": "wpc_v2_lazy_opcache_invalidate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated forced opcode cache invalidation via wpc_v2_lazy_opcache_invalidate AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73343-03": {"ajax_action": "wpc_v2_lazy_test_purge_html", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated local file inclusion via image_id parameter in wpc_v2_lazy_test_purge_html AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "local-file-inclusion"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73343-04": {"ajax_action": "wpc_v2_provision_now", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73343", "description": "WP Compress <7.20.01 unauthenticated CDN/config provisioning via wpc_v2_provision_now AJAX action lacking any WordPress nonce or capability check", "mode": "block", "severity": 10.0, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<7.20.01"}, "RULE-CVE-2026-73348-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-form-preview"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73348", "description": "GiveWP <4.16.6 missing capability check on onboarding form preview allows unauthorized access via page=give-form-preview", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<4.16.6"}, "RULE-CVE-2026-73355-01": {"ajax_action": "wpam_ajax_activate_affiliate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_activate_affiliate AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-02": {"ajax_action": "wpam_ajax_deactivate_affiliate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_deactivate_affiliate AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-03": {"ajax_action": "wpam_ajax_add_transaction", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_add_transaction AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-04": {"ajax_action": "wpam_ajax_delete_creative", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_delete_creative AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73355-05": {"ajax_action": "wpam_ajax_set_creative_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-73355", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73355", "description": "Affiliates Manager <2.9.54 missing authorization on wpam_ajax_set_creative_status AJAX handler", "mode": "block", "severity": 9.3, "slug": "affiliates-manager", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<2.9.54"}, "RULE-CVE-2026-73356-01": {"action": "init", "conditions": [{"name": "REQUEST_COOKIES:/wcml_client_currency|aelia_cs_selected_currency/", "type": "regex", "value": "~^(?![A-Za-z]{3}$).+~"}], "cve": "CVE-2026-73356", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73356", "description": "Breeze <=2.5.12 unauthenticated cache-variation cookie value manipulation via wcml_client_currency/aelia_cs_selected_currency", "mode": "block", "severity": 8.2, "slug": "breeze", "tags": ["cache-poisoning", "header-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.5.12"}, "RULE-CVE-2026-73381-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~::~"}], "cve": "CVE-2026-73381", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73381", "description": "Popup by Supsystic <=1.13.0 unauthenticated broken authentication via PHP Class::method callable-syntax injection in dynamic admin-ajax action parameter", "mode": "block", "severity": 9.1, "slug": "popup-by-supsystic", "tags": ["missing-authorization", "broken-authentication", "unauthenticated"], "target": "plugin", "versions": "<=1.13.0"}, "RULE-CVE-2026-73382-01": {"action": "init", "conditions": [{"name": "ARGS:_rendered", "type": "exists"}, {"type": "missing_capability", "value": "create_posts"}], "cve": "CVE-2026-73382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73382", "description": "Site Reviews <=8.2.0 reported unauthenticated XSS; only grounded evidence is the REST review-creation _rendered field gated by create_posts capability (advisory-vs-code contradiction unresolved, no source-to-sink trace, REST route not statically literal, capability backstop only)", "mode": "block", "severity": 7.1, "slug": "site-reviews", "tags": ["xss", "rest-api", "authorization-contradiction"], "target": "plugin", "versions": "<=8.2.0"}, "RULE-CVE-2026-73992-01": {"ajax_action": "qw_form_ajax", "conditions": [{"name": "ARGS:form", "type": "equals", "value": "preview"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-73992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73992", "description": "Query Wrangler <=1.5.57 registers qw_form_ajax on wp_ajax_ only (no nopriv), so any logged-in user reaches it. The preview branch urldecode()s the options parameter and parse_str()s it into query options that reach three callable sinks gated only by function_exists(): includes/fields/callback_field.php:29 (custom_output_callback), includes/filters/post_id.php:56 (post_ids_callback) and includes/filters/callback.php:57 (callback). 1.5.58 fixes it by requiring edit_others_posts on the whole endpoint, which is what this rule enforces. Matching the sink names instead is not viable: admin/ajax.php:11 urldecode()s options a SECOND time after PHP already form-decoded it, while the engine reads $_POST, so any sink name survives one extra percent-encoding layer (custom_output_%2563allback) and the real wire format of the third sink is %5Bcallback%5D, which no literal [callback] pattern can match.", "method": "POST", "mode": "block", "severity": 9.9, "slug": "query-wrangler", "tags": ["remote-code-execution", "authenticated", "missing-capability"], "target": "plugin", "versions": "<=1.5.57"}, "RULE-CVE-2026-73994-01": {"ajax_action": "charitable_update_debug_window_ajax", "conditions": [{"type": "missing_capability", "value": "manage_charitable_settings"}], "cve": "CVE-2026-73994", "description": "Charitable <=1.8.11.3 unauthenticated access to debug window AJAX handler via missing authorization on charitable_update_debug_window_ajax", "mode": "block", "severity": 7.5, "slug": "charitable", "target": "plugin", "versions": "<=1.8.11.3"}, "RULE-CVE-2026-73996-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/masteriyo/pro/v1/certificate-pdf-email[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-73996", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73996", "description": "Masteriyo LMS <=2.3.2 unauthenticated arbitrary file upload via certificate-pdf-email REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["arbitrary-file-upload", "unauthenticated", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2026-73996-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/masteriyo/pro/v1/certificate-pdf-email[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-73996", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73996", "description": "Masteriyo LMS <=2.3.2 unauthenticated arbitrary file upload via certificate-pdf-email REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["arbitrary-file-upload", "unauthenticated", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2026-73997-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/kadence-starter-library/v1/process_images[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:sizes[50]", "type": "exists"}], "cve": "CVE-2026-73997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73997", "description": "Starter Templates by Kadence WP <=2.3.3 unauthenticated denial of service via unbounded image sizes array in process_images REST endpoint", "mode": "block", "severity": 7.5, "slug": "kadence-starter-templates", "tags": ["denial-of-service", "resource-exhaustion", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-73997-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/kadence-starter-library/v1/process_images[\\\\\\\\/]*$~i"}, {"name": "ARGS:sizes[50]", "type": "exists"}], "cve": "CVE-2026-73997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-73997", "description": "Starter Templates by Kadence WP <=2.3.3 unauthenticated denial of service via unbounded image sizes array in process_images REST endpoint", "mode": "block", "severity": 7.5, "slug": "kadence-starter-templates", "tags": ["denial-of-service", "resource-exhaustion", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-7465-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (classic editor)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-7465-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (REST API)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-74851-01": {"ajax_action": "pods_admin", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-74851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74851", "description": "Pods <3.3.9.1 unauthenticated access to pods_admin AJAX handler (wp_ajax_nopriv_pods_admin) removed in 3.3.9.1 hardening", "mode": "block", "severity": 7.2, "slug": "pods", "tags": ["missing-authorization", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<3.3.9.1"}, "RULE-CVE-2026-74851-02": {"ajax_action": "pods_admin_components", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-74851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74851", "description": "Pods <3.3.9.1 unauthenticated access to pods_admin_components AJAX handler (wp_ajax_nopriv_pods_admin_components) removed in 3.3.9.1 hardening", "mode": "block", "severity": 7.2, "slug": "pods", "tags": ["missing-authorization", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<3.3.9.1"}, "RULE-CVE-2026-74992-01": {"ajax_action": "kirki_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "regex", "value": "~(?:upload[_-]?font[_-]?zip|upload[_-]?fonts?)~i"}], "cve": "CVE-2026-74992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74992", "description": "Kirki <=6.2.2 authenticated (Editor+) unrestricted custom-font archive upload leading to stored XSS/RCE via kirki_post_apis AJAX endpoint dispatch", "mode": "block", "severity": 6.8, "slug": "kirki", "tags": ["unrestricted-file-upload", "stored-xss", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2026-74992-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "regex", "value": "~(?:upload[_-]?font[_-]?zip|upload[_-]?fonts?)~i"}], "cve": "CVE-2026-74992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74992", "description": "Kirki <=6.2.2 authenticated (Editor+) unrestricted custom-font archive upload leading to stored XSS/RCE via kirki_wp_admin_post_apis AJAX endpoint dispatch", "mode": "block", "severity": 6.8, "slug": "kirki", "tags": ["unrestricted-file-upload", "stored-xss", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2026-75528-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blc_local"}, {"name": "ARGS:filter_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<\\\\/script|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\'\\"]\\\\s*;?\\\\s*(?:alert|eval|prompt|confirm|document\\\\.[a-zA-Z]+)\\\\s*\\\\()~i"}], "cve": "CVE-2026-75528", "description": "Broken Link Checker <=2.4.13 reflected XSS via filter_id parameter on the Links admin page (blc_local), a secondary defect hardened in the same 2.4.13.1 patch that also fixed the primary stored XSS via comment author URL / link log", "mode": "block", "slug": "broken-link-checker", "target": "plugin", "versions": "<=2.4.13"}, "RULE-CVE-2026-75586-01": {"action": "wp", "conditions": [{"name": "ARGS:ucfrontajaxaction", "type": "equals", "value": "submitform"}, {"name": "ARGS:formData[/.*/]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg|<iframe)~i"}], "cve": "CVE-2026-75586", "description": "Unlimited Elements For Elementor <=2.0.17 unauthenticated reflected XSS via formData parameter on public wp-hooked submitform handler", "mode": "block", "slug": "unlimited-elements-for-elementor", "target": "plugin", "versions": "<=2.0.17"}, "RULE-CVE-2026-7567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]temp-login-token\\\\[~"}], "cve": "CVE-2026-7567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7567", "description": "Temporary Login <=1.0.0 authentication bypass via non-scalar temp-login-token array parameter", "mode": "block", "severity": 9.8, "slug": "temporary-login", "tags": ["authentication-bypass", "unauthenticated", "cwe-288"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-75796-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mcp/v1/http[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to create privileged accounts via MCP REST endpoint /wp-json/mcp/v1/http missing create_users capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75796-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mcp/v1/http[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to create privileged accounts via MCP REST endpoint /wp-json/mcp/v1/http missing create_users capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75796-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mcp/v1/http[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "edit_user"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to take over arbitrary network accounts via MCP REST endpoint /wp-json/mcp/v1/http missing per-target edit_user capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "account-takeover", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75796-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mcp/v1/http[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "edit_user"}], "cve": "CVE-2026-75796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75796", "description": "AI Engine <3.6.1 improper privilege management allows Multisite sub-site Administrator to take over arbitrary network accounts via MCP REST endpoint /wp-json/mcp/v1/http missing per-target edit_user capability check", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["privilege-escalation", "improper-authorization", "multisite", "account-takeover", "rest-api"], "target": "plugin", "versions": "<3.6.1"}, "RULE-CVE-2026-75797-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai-ui/v1/editor/submit[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-75797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75797", "description": "AI Engine <3.7.2 missing authorization on /editor/submit REST endpoint allows any nonce-holding authenticated user to invoke the AI editor assistant without a capability check", "mode": "block", "severity": 7.7, "slug": "ai-engine", "tags": ["missing-authorization", "rest-api", "authenticated"], "target": "plugin", "versions": "<3.7.2"}, "RULE-CVE-2026-75797-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai-ui/v1/editor/submit[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-75797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75797", "description": "AI Engine <3.7.2 missing authorization on /editor/submit REST endpoint allows any nonce-holding authenticated user to invoke the AI editor assistant without a capability check", "mode": "block", "severity": 7.7, "slug": "ai-engine", "tags": ["missing-authorization", "rest-api", "authenticated"], "target": "plugin", "versions": "<3.7.2"}, "RULE-CVE-2026-75981-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~#!trpst#.*?(?:on(?:error|load|click|mouseover|mouseenter|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|\\\\b(?:script|img|svg|iframe|body|input|style|object|embed|marquee)\\\\b).*?#!trpen#~is"}], "cve": "CVE-2026-75981", "description": "TranslatePress <=3.2.5 unauthenticated stored XSS via \'#!trpst#\'/\'#!trpen#\' gettext marker smuggling in wp-comments-post.php comment field", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2026-76053-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~___noise___~"}], "cve": "CVE-2026-76053", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76053", "description": "TranslatePress <=3.3.3 unauthenticated stored XSS - forged simple_html_dom \\"___noise___\\" placeholder in comment content is restored into an attribute value, breaking out of the quotes during translation render", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2026-7649-01": {"ajax_action": "arm_directory_paging_action", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:--|#)(?:\\\\s|$)|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\b.*\\\\bWHEN\\\\b|\\\\b(?:SLEEP|BENCHMARK)\\\\s*\\\\()~i"}], "cve": "CVE-2026-7649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7649", "description": "ARMember <=4.0.60 unauthenticated blind SQL injection via orderby parameter", "mode": "block", "severity": 8.8, "slug": "armember-membership", "tags": ["sql-injection", "unauthenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=4.0.60"}, "RULE-CVE-2026-7654-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\{?\\"~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via classic editor post meta (metavalue) leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-7654-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[a-zA-Z]~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via REST API post meta leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-76548-01": {"action": "current_screen", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:wppb_upload", "type": "equals", "value": "true"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-76548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76548", "description": "Profile Builder <4.0.1 unauthenticated privilege escalation via front-end upload bootstrap grants elevated media/post capabilities", "mode": "block", "severity": 8.2, "slug": "profile-builder", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated", "file-upload"], "target": "plugin", "versions": ">=3.8.1 <4.0.1"}, "RULE-CVE-2026-76549-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:action", "type": "equals", "value": "updraft_restore"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-76549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76549", "description": "UpdraftPlus <1.26.7 CSRF on direct backup-restore dispatch via admin.php?page=updraftplus&action=updraft_restore", "mode": "block", "severity": 5.9, "slug": "updraftplus", "tags": ["csrf", "missing-authorization", "backup-restore"], "target": "plugin", "versions": "<1.26.7"}, "RULE-CVE-2026-76549-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:action", "type": "equals", "value": "updraft_restore_continue"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-76549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76549", "description": "UpdraftPlus <1.26.7 CSRF on direct backup-restore-continue dispatch via admin.php?page=updraftplus&action=updraft_restore_continue", "mode": "block", "severity": 5.9, "slug": "updraftplus", "tags": ["csrf", "missing-authorization", "backup-restore"], "target": "plugin", "versions": "<1.26.7"}, "RULE-CVE-2026-76550-01": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS:/fileName|fileDir|extra_copy_path/", "type": "regex", "value": "~(?:\\\\.\\\\.|\\\\x00|:)~"}], "cve": "CVE-2026-76550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76550", "description": "WP Import Export Lite <=3.9.33 authenticated (export-capability holder) arbitrary file write via unvalidated fileName/fileDir/extra_copy_path in wpie_export_create_data", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["path-traversal", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2026-76550-02": {"ajax_action": "wpie_export_prepare_file", "conditions": [{"name": "ARGS:/fileName|fileDir|extra_copy_path/", "type": "regex", "value": "~(?:\\\\.\\\\.|\\\\x00|:)~"}], "cve": "CVE-2026-76550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76550", "description": "WP Import Export Lite <=3.9.33 authenticated (export-capability holder) arbitrary file write via unvalidated fileName/fileDir/extra_copy_path in wpie_export_prepare_file", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["path-traversal", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2026-76551-01": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\b(?:eval|assert|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|create_function|call_user_func(?:_array)?)\\\\b~i"}], "cve": "CVE-2026-76551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76551", "description": "WP Import Export Lite <=3.9.32 authenticated PHP code execution via unrestricted export field-value function selection in wpie_export_create_data", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.9.32"}, "RULE-CVE-2026-76551-02": {"ajax_action": "wpie_export_update_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\b(?:eval|assert|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|create_function|call_user_func(?:_array)?)\\\\b~i"}], "cve": "CVE-2026-76551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76551", "description": "WP Import Export Lite <=3.9.32 authenticated PHP code execution via unrestricted export field-value function selection in wpie_export_update_data", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.9.32"}, "RULE-CVE-2026-76551-03": {"ajax_action": "wpie_export_save_template", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\b(?:eval|assert|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|create_function|call_user_func(?:_array)?)\\\\b~i"}], "cve": "CVE-2026-76551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76551", "description": "WP Import Export Lite <=3.9.32 authenticated PHP code execution via unrestricted export field-value function selection in wpie_export_save_template", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["code-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.9.32"}, "RULE-CVE-2026-76554-01": {"ajax_action": "wpie_import_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-76554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-76554", "description": "WP Import Export Lite <=3.9.34 improper privilege management allows delegated import users to create or modify administrator accounts via wpie_import_data AJAX action", "mode": "block", "severity": 7.2, "slug": "wp-import-export-lite", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.9.34"}, "RULE-CVE-2026-76585-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:review", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseleave|change|submit)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img[^>]*onerror)~i"}], "cve": "CVE-2026-76585", "description": "Customer Reviews for WooCommerce <5.118.0 unauthenticated stored XSS via review parameter in cr_submit_review AJAX action", "mode": "block", "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.118.0"}, "RULE-CVE-2026-7660-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "easy-updates-manager"}, {"name": "ARGS:paged", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:img|svg|iframe|object|embed|details|body|input|select|textarea|form|marquee|a)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-7660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7660", "description": "Easy Updates Manager <=9.0.20 reflected XSS via paged parameter in pagination()", "method": "GET", "mode": "block", "severity": 6.1, "slug": "stops-core-theme-and-plugin-updates", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.0.20"}, "RULE-CVE-2026-77233-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?=.*google_ad_(?:client|slot|width|height)\\\\s*=)(?=.*pagead2\\\\.googlesyndication\\\\.com/pagead/show_ads\\\\.js)~is"}], "cve": "CVE-2026-77233", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77233", "description": "iubenda Cookie Law Solution <=3.13.4 unauthenticated stored XSS via WordPress comment content triggering legacy AdSense regex rewrite in the Secondary parser engine", "mode": "block", "severity": 7.2, "slug": "iubenda-cookie-law-solution", "tags": ["xss", "stored", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=3.13.4"}, "RULE-CVE-2026-77752-01": {"ajax_action": "wtlwp_enable_one_click_login", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_network"}], "cve": "CVE-2026-77752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77752", "description": "Temporary Login Without Password <1.9.9 network super-admin privilege escalation via wtlwp_enable_one_click_login AJAX handler\'s unguarded update_user() call", "mode": "block", "severity": 7.2, "slug": "temporary-login-without-password", "tags": ["privilege-escalation", "missing-authorization", "multisite"], "target": "plugin", "versions": "<1.9.9"}, "RULE-CVE-2026-77770-01": {"ajax_action": "mo_two_factor_ajax", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-77770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77770", "description": "miniOrange 2FA <6.3.1 unauthenticated arbitrary site-option deletion via mo_two_factor_ajax AJAX action missing authorization", "mode": "block", "severity": 10.0, "slug": "miniorange-2-factor-authentication", "tags": ["missing-authorization", "unauthenticated", "option-deletion"], "target": "plugin", "versions": "<6.3.1"}, "RULE-CVE-2026-77770-02": {"ajax_action": "mo_two_factor_ajax", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-77770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77770", "description": "miniOrange 2FA >=18.0 <19.3 unauthenticated arbitrary site-option deletion via mo_two_factor_ajax AJAX action missing authorization", "mode": "block", "severity": 10.0, "slug": "miniorange-2-factor-authentication", "tags": ["missing-authorization", "unauthenticated", "option-deletion"], "target": "plugin", "versions": ">=18.0 <19.3"}, "RULE-CVE-2026-77782-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/getHead(?:[/?]|$)~i"}, {"name": "ARGS:url", "type": "exists"}], "cve": "CVE-2026-77782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77782", "description": "Rank Math SEO <1.0.277.1 discloses password-protected post content via publicly generated SEO metadata reachable through the headless getHead REST endpoint; endpoint-scoping only, no exploit-specific payload signal is groundable from current evidence", "mode": "block", "severity": 5.3, "slug": "seo-by-rank-math", "tags": ["information-disclosure", "unauthenticated", "needs-human-review"], "target": "plugin", "versions": "<1.0.277.1"}, "RULE-CVE-2026-77830-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\'][^\\"\'<>]{0,40}(?:on\\\\w+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-77830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77830", "description": "CleanTalk Spam Protection, Antispam, FireWall by CleanTalk <=6.86 stored XSS via comment-content attribute breakout of ContactsEncoder aria-label placeholder", "mode": "block", "severity": 7.2, "slug": "cleantalk-spam-protect", "tags": ["xss", "stored", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=6.86"}, "RULE-CVE-2026-7795-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through classic editor post.php", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-7795-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-78003-01": {"ajax_action": "add_list", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~addresses\\\\[[^\\\\]]*(?:/|%2f|%2e%2e|\\\\.\\\\.)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-78003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78003", "description": "Mailgun for WordPress <=2.2.0 unauthenticated SSRF via path traversal in addresses[] array key in add_list AJAX handler", "mode": "block", "severity": 9.8, "slug": "mailgun", "tags": ["ssrf", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2026-78006-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<!--\\\\s*wp:legacy-widget\\\\b[^>]*\\"idBase\\"\\\\s*:\\\\s*\\"tribe-widget-[^\\"]*\\"[^>]*\\"encoded\\"\\\\s*:\\\\s*\\"[^\\"]+\\"[^>]*\\"hash\\"\\\\s*:\\\\s*\\"[^\\"]+\\"~i"}], "cve": "CVE-2026-78006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78006", "description": "The Events Calendar <=6.17.4 unauthenticated PHP object injection via forged widget-instance block markup in comment content later processed by do_blocks() on the single-event template", "mode": "block", "severity": 9.8, "slug": "the-events-calendar", "tags": ["object-injection", "deserialization", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=6.17.4"}, "RULE-CVE-2026-78159-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "contains", "value": "wp:legacy-widget"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\"classes\\"\\\\s*:\\\\s*[\\\\s\\\\S]{0,300}?\\\\[\\\\s*\\"[^\\"]{1,100}\\"\\\\s*,\\\\s*\\"[^\\"]{1,100}\\"\\\\s*\\\\]~i"}], "cve": "CVE-2026-78159", "description": "The Events Calendar <=6.17.3 unauthenticated remote code execution via crafted wp:legacy-widget classes callable array submitted through comment content", "mode": "block", "slug": "the-events-calendar", "target": "plugin", "versions": "<=6.17.3"}, "RULE-CVE-2026-78175-01": {"ajax_action": "tutor_save_withdraw_account", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78175", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78175", "description": "Tutor LMS <=4.0.7 authenticated (subscriber+) PHP object injection via serialized payload in withdraw_method_field key names in tutor_save_withdraw_account AJAX handler", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2026-78175-02": {"ajax_action": "tutor_save_withdraw_account", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78175", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78175", "description": "Tutor LMS <=4.0.7 authenticated (subscriber+) PHP object injection via serialized payload values submitted to tutor_save_withdraw_account AJAX handler", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2026-78262-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;{}])[OC]:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78262", "description": "WP Project Manager <4.0.7 unauthenticated PHP object injection via unserialize() in Comment/Activity model accessors", "mode": "block", "severity": 9.8, "slug": "wedevs-project-manager", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<4.0.7"}, "RULE-CVE-2026-78292-01": {"ajax_action": "hashform_process_entry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-78292", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78292", "description": "Hash Form <=1.4.1 unauthenticated PHP Object Injection via hashform_process_entry form submission", "mode": "block", "severity": 9.8, "slug": "hash-form", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2026-78295-01": {"ajax_action": "xagio_announcements", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-78295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78295", "description": "Xagio SEO <=7.1.0.43 CSRF via xagio_announcements AJAX handler lacking nonce and capability checks", "mode": "block", "severity": 8.8, "slug": "xagio-seo", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=7.1.0.43"}, "RULE-CVE-2026-78438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~background(?:-image)?\\\\s*:\\\\s*url\\\\s*\\\\(\\\\s*[\'\\"]?\\\\s*(?!https?\\\\s*:)[a-zA-Z][a-zA-Z0-9+.\\\\-]*\\\\s*:~i"}], "cve": "CVE-2026-78438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-78438", "description": "W3 Total Cache <=2.10.5 unauthenticated stored XSS via non-http(s) scheme CSS background-image url() in comment content rendered by LazyLoad Background Mutator", "mode": "block", "severity": 7.2, "slug": "w3-total-cache", "tags": ["stored-xss", "unauthenticated", "comment-content"], "target": "plugin", "versions": "<=2.10.5"}, "RULE-CVE-2026-80071-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-80071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-80071", "description": "User Registration & Membership <5.2.8 requires authentication for membership AJAX action family (user_registration_membership_$ajax_event) after fix removed anonymous wp_ajax_nopriv_ registration for this dynamic dispatch family", "mode": "block", "severity": 7.2, "slug": "user-registration", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<5.2.8"}, "RULE-CVE-2026-8073-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8073-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/|(?:^|&|\\\\?)rest_route=/)[^?&]*(?:downloadZIP|download-zip|download_zip)~i"}, {"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter (rest_route query form)", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8089-01": {"ajax_action": "wemail_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wemail_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|animationstart)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|on[a-z]+=))~i"}], "cve": "CVE-2026-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8089", "description": "weMail <2.1.3 reflected XSS via shortcode parameter in wemail_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wemail", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-8096-01": {"ajax_action": "kirki_wp_admin_get_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_get_apis allows subscriber+ to read sensitive form submission data", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8096-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_post_apis allows subscriber+ to access admin-restricted POST API", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-81271-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?=.*?/geodir/)(?=.*?/markers/)~i"}, {"name": "ARGS:_wpnonce", "type": "exists"}, {"name": "ARGS:_method", "type": "regex", "value": "~^(?!(?:GET|HEAD)$).+~i"}], "cve": "CVE-2026-81271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81271", "description": "GeoDirectory <=2.8.176 unauthenticated CSRF via markers REST route nonce-bypass exception using HTTP method override", "mode": "block", "severity": 8.8, "slug": "geodirectory", "tags": ["csrf", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.8.176"}, "RULE-CVE-2026-81283-01": {"ajax_action": "wpuf_get_child_cat", "conditions": [{"name": "ARGS:/catID|field_attr|form_id/", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-81283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81283", "description": "WP User Frontend <=4.3.10 PHP object injection via wpuf_get_child_cat AJAX unserialize() call", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=4.3.10"}, "RULE-CVE-2026-81287-01": {"ajax_action": "charitable_report_donor_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81287", "description": "Charitable <=1.8.12.1 subscriber-accessible SQL injection via charitable_report_donor_data AJAX report endpoint (missing capability check)", "mode": "block", "severity": 8.5, "slug": "charitable", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.8.12.1"}, "RULE-CVE-2026-81287-02": {"ajax_action": "charitable_report_donor_data_pagination", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81287", "description": "Charitable <=1.8.12.1 subscriber-accessible SQL injection via charitable_report_donor_data_pagination AJAX report endpoint (missing capability check)", "mode": "block", "severity": 8.5, "slug": "charitable", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.8.12.1"}, "RULE-CVE-2026-81290-01": {"ajax_action": "es_add_subscriber", "conditions": [{"name": "ARGS:es", "type": "regex", "value": "~^(?:[a-z][a-z0-9+.\\\\-]*:)?[\\\\\\\\/]{2}~i"}], "cve": "CVE-2026-81290", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81290", "description": "Email Subscribers & Newsletters <=5.9.33 unauthenticated open redirect via es parameter in es_add_subscriber AJAX handler", "mode": "block", "severity": 7.1, "slug": "email-subscribers", "tags": ["open-redirect", "unauthenticated"], "target": "plugin", "versions": "<=5.9.33"}, "RULE-CVE-2026-81291-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:uncode_bread_bg_image", "type": "regex", "value": "~(?:javascript\\\\s*:|[\'\\"]\\\\s*\\\\)\\\\s*;?\\\\s*[\\"\']|<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-81291", "description": "Uncode theme <2.12.8 unauthenticated stored XSS via unsanitized uncode_bread_bg_image breadcrumb background image post meta", "mode": "block", "slug": "uncode", "target": "theme", "versions": "<2.12.8"}, "RULE-CVE-2026-81293-01": {"ajax_action": "wpda_global_replace", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81293", "description": "WP Data Access <=5.5.81 authenticated SQL injection via wpda_global_replace AJAX action reaching WPDA_Global_Search::replace with no capability check", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.5.81"}, "RULE-CVE-2026-81295-01": {"ajax_action": "ucp_submit_support_message", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81295", "description": "Under Construction <=5.82 authenticated missing-authorization on ucp_submit_support_message AJAX handler", "mode": "block", "severity": 7.1, "slug": "under-construction-page", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=5.82"}, "RULE-CVE-2026-8163-01": {"ajax_action": "infility_redirect", "conditions": [{"name": "ARGS:RId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8163", "description": "Infility Global <2.15.19 authenticated (Subscriber+) SQL injection via RId parameter in infility_redirect AJAX handler", "mode": "block", "severity": 8.8, "slug": "infility-global", "target": "plugin", "versions": "<2.15.19"}, "RULE-CVE-2026-81650-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "manage-galleries"}, {"name": "ARGS:bulkaction", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81650", "description": "NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) <4.5.0 missing authorization on bulkaction parameter in legacy manage-galleries admin page", "mode": "block", "severity": 7.2, "slug": "nextgen-gallery", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<4.5.0"}, "RULE-CVE-2026-8172-01": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_name parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-02": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_email parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-03": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_message", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_message parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-04": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_subject", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_subject parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-81766-01": {"ajax_action": "rsp_upgrade_install_plugin", "conditions": [{"name": "ARGS:download_link", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-81766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81766", "description": "Really Simple Security <9.8.0 subsite administrator privilege escalation via unauthorized plugin install in rsp_upgrade_install_plugin AJAX handler", "mode": "block", "severity": 6.6, "slug": "really-simple-ssl", "tags": ["missing-authorization", "privilege-escalation", "multisite", "plugin-installation"], "target": "plugin", "versions": "<9.8.0"}, "RULE-CVE-2026-81766-02": {"ajax_action": "rsp_upgrade_activate_plugin", "conditions": [{"name": "ARGS:plugin", "type": "exists"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-81766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81766", "description": "Really Simple Security <9.8.0 subsite administrator privilege escalation via unauthorized plugin activation in rsp_upgrade_activate_plugin AJAX handler", "mode": "block", "severity": 6.6, "slug": "really-simple-ssl", "tags": ["missing-authorization", "privilege-escalation", "multisite", "plugin-activation"], "target": "plugin", "versions": "<9.8.0"}, "RULE-CVE-2026-81770-01": {"ajax_action": "csf-export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-81770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81770", "description": "Interactive Geo Maps <=1.6.30 missing capability check on csf-export AJAX handler discloses arbitrary stored WordPress options", "mode": "block", "severity": 7.1, "slug": "interactive-geo-maps", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=1.6.30"}, "RULE-CVE-2026-81780-01": {"ajax_action": "hashform_file_upload_action", "conditions": [{"name": "ARGS:allowedExtensions", "type": "regex", "value": "~(?:^|[,;])\\\\s*\\\\.?(?:ph(?:p[2-8]?|tml?|t|ar)|pht|phps|s?html?|cgi|pl|py3?|rb|sh|asp|aspx|jsp|jspx|cfm|exe|dll)\\\\s*(?:[,;]|$)~i"}], "cve": "CVE-2026-81780", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81780", "description": "Hash Form <=1.4.2 unauthenticated arbitrary file upload via client-controlled allowedExtensions in hashform_file_upload_action AJAX handler", "mode": "block", "severity": 10.0, "slug": "hash-form", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-81806-01": {"ajax_action": "hmwp_passkey_begin", "conditions": [{"name": "ARGS:credential", "type": "regex", "value": "~(?:file|gopher|dict|ftp|php|expect|s3)://|(?:^|[\\"\'@/])(?:127\\\\.0\\\\.0\\\\.1|localhost|0\\\\.0\\\\.0\\\\.0|169\\\\.254\\\\.169\\\\.254|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[0-1])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3})~i"}], "cve": "CVE-2026-81806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-81806", "description": "Hide My WP Ghost <=7.0.09 unauthenticated hmwp_passkey_begin AJAX action (no nonce/capability check) carries a credential parameter inspected here for SSRF-indicative URL schemes and internal-network targets pending confirmed sink evidence", "mode": "block", "severity": 7.2, "slug": "hide-my-wp", "tags": ["ssrf", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=7.0.09"}, "RULE-CVE-2026-82222-01": {"ajax_action": "give_get_donor_comments", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-82222", "description": "GiveWP <=4.16.7.1 unauthenticated PHP object injection via data parameter in give_get_donor_comments AJAX handler", "mode": "block", "severity": 10.0, "slug": "give", "target": "plugin", "versions": "<=4.16.7.1"}, "RULE-CVE-2026-82228-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/xmlrpc\\\\.php~i"}], "cve": "CVE-2026-82228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82228", "description": "SiteGround Security <1.6.7 unauthenticated 2FA bypass via XML-RPC authentication for accounts requiring two-factor authentication", "mode": "block", "severity": 8.1, "slug": "sg-security", "tags": ["authentication-bypass", "two-factor-bypass", "xmlrpc", "unauthenticated"], "target": "plugin", "versions": "<1.6.7"}, "RULE-CVE-2026-82607-01": {"ajax_action": "wppb_ajax_simple_avatar", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^name\\\\[~"}], "cve": "CVE-2026-82607", "description": "Profile Builder <=3.16.1 unrestricted upload via array-type name parameter bypass in wppb_ajax_simple_avatar AJAX handler", "mode": "block", "slug": "profile-builder", "target": "plugin", "versions": ">=3.16.0 <=3.16.1"}, "RULE-CVE-2026-82845-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-82845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82845", "description": "Masteriyo LMS <3.4.1 PHP object injection via unsanitized deserialization of stored metadata", "mode": "block", "severity": 9.9, "slug": "learning-management-system", "tags": ["object-injection", "deserialization", "php-object-injection"], "target": "plugin", "versions": "<3.4.1"}, "RULE-CVE-2026-82884-01": {"action": "admin_init", "conditions": [{"name": "ARGS:aioseo-quick-robots-submitted", "type": "exists"}, {"type": "missing_capability", "value": "aioseo_page_general_settings"}], "cve": "CVE-2026-82884", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82884", "description": "All in One SEO <5.0.0.1 missing authorization on Quick Edit inline robots-meta save (saveRobotsFields) hardened in the same release that fixed contributor-triggered stored XSS in post editor rendering", "mode": "block", "severity": 6.8, "slug": "all-in-one-seo-pack", "tags": ["missing-authorization", "stored-xss", "contributor", "quick-edit"], "target": "plugin", "versions": "<5.0.0.1"}, "RULE-CVE-2026-82884-02": {"action": "admin_init", "conditions": [{"name": "ARGS:aioseo-bulk-robots-submitted", "type": "exists"}, {"type": "missing_capability", "value": "aioseo_page_general_settings"}], "cve": "CVE-2026-82884", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82884", "description": "All in One SEO <5.0.0.1 missing authorization on Bulk Edit robots-meta save (saveRobotsFields) hardened in the same release that fixed contributor-triggered stored XSS in post editor rendering", "mode": "block", "severity": 6.8, "slug": "all-in-one-seo-pack", "tags": ["missing-authorization", "stored-xss", "contributor", "bulk-edit"], "target": "plugin", "versions": "<5.0.0.1"}, "RULE-CVE-2026-82970-01": {"ajax_action": "gcc_update_imported_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-82970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-82970", "description": "GDPR Cookie Consent <=4.4.1 authenticated arbitrary file upload via gcc_update_imported_settings AJAX action missing capability check", "mode": "block", "severity": 10.0, "slug": "gdpr-cookie-consent", "tags": ["arbitrary-file-upload", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2026-83561-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment_post_ID", "type": "exists"}, {"name": "ARGS:comment", "type": "regex", "value": "~elementor-widget-(?:facebook|twitter)-[^\\"\']{0,200}?data-href\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*>|<script|on\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2026-83561", "description": "Complianz GDPR/CCPA Cookie Consent Banner <=7.5.4 unauthenticated stored XSS via comment content abusing Elementor cookie blocker Facebook/Twitter widget regex detection", "mode": "block", "slug": "complianz-gdpr", "target": "plugin", "versions": "<=7.5.4"}, "RULE-CVE-2026-83627-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:Cookie", "type": "regex", "value": "~wphb_cache_[^;=]*(?:<\\\\?|%3[Cc]%3[Ff])~i"}], "cve": "CVE-2026-83627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-83627", "description": "Hummingbird Performance <=3.21.0 unauthenticated remote code execution via wphb_cache_ cookie name PHP tag injection", "mode": "block", "severity": 9.8, "slug": "hummingbird-performance", "tags": ["remote-code-execution", "code-injection", "unauthenticated", "log-poisoning"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-83627-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wphb-logs/page-caching-log\\\\.php~i"}], "cve": "CVE-2026-83627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-83627", "description": "Hummingbird Performance <=3.21.0 unauthenticated direct access to page-caching-log.php RCE payload execution", "mode": "block", "severity": 9.8, "slug": "hummingbird-performance", "tags": ["remote-code-execution", "unauthenticated", "log-poisoning"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-8365-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v[12]/(?:posts|pages|[a-z_-]+)/[0-9]+~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-8365", "description": "Blocksy <=2.1.41 authenticated PHP Object Injection via blocksy_meta REST field leading to RCE", "mode": "block", "severity": 8.8, "slug": "blocksy", "target": "theme", "versions": "<=2.1.41"}, "RULE-CVE-2026-8379-01": {"action": "init", "conditions": [{"name": "ARGS:file_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-8379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8379", "description": "Frontend File Manager Plugin <=23.6 unauthenticated file download via IDOR on file_id parameter", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=23.6"}, "RULE-CVE-2026-8382-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_title", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post title overwrite via _post_title in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-8382-02": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_content", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post content overwrite via _post_content in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-84021-01": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bt_bb_button\\\\b[^\\\\]]{0,300}?url\\\\s*=\\\\s*(?:&quot;|\\"|\')[^\\"\'&]{0,60}(?:j[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*v[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*s[\\\\x00-\\\\x20]*c[\\\\x00-\\\\x20]*r[\\\\x00-\\\\x20]*i[\\\\x00-\\\\x20]*p[\\\\x00-\\\\x20]*t|vbscript|data|%6a%61%76%61%73%63%72%69%70%74|&#0*106;|&#x0*6a;)[\\\\x00-\\\\x20]*:~i"}], "cve": "CVE-2026-84021", "description": "Bold Page Builder <5.9.8 contributor+ stored XSS via obfuscated dangerous URL scheme in bt_bb_button shortcode saved through bt_bb_fe_save", "mode": "block", "slug": "bold-page-builder", "target": "plugin", "versions": "<5.9.8"}, "RULE-CVE-2026-84028-01": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*(?:\\"[^\\"]*(?:\'|<[a-zA-Z]|on\\\\w+\\\\s*=|javascript\\\\s*:)|\'[^\']*(?:\\"|<[a-zA-Z]|on\\\\w+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2026-84028", "description": "Bold Page Builder <5.9.9 stored XSS via unsanitized additional_settings shortcode attribute submitted through bt_bb_fe_save AJAX save handler", "mode": "block", "slug": "bold-page-builder", "target": "plugin", "versions": "<5.9.9"}, "RULE-CVE-2026-84219-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~&(?:Lt|lT|LT|Gt|gT|GT);~"}], "cve": "CVE-2026-84219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84219", "description": "Kirki <6.3.0 stored XSS via case-variant HTML entity spellings bypassing render-time entity holdback in comment content", "mode": "block", "severity": 7.5, "slug": "kirki", "tags": ["xss", "stored", "unauthenticated", "entity-decoding-bypass"], "target": "plugin", "versions": "<6.3.0"}, "RULE-CVE-2026-8438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C(?:script|img|svg|iframe|object|embed|details|body|input|form|link|meta|style|marquee|video|audio|math|a(?:%20|\\\\+|%09|/|%2F))(?:%20|%09|%0[aAdD]|\\\\+|%3E|%2F|/)~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded HTML tags in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-8438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C[a-zA-Z][^%]*(?:%20|\\\\+|%09|/)on(?:error|load|click|mouseover|focus|blur|submit|change|input|animationend|toggle)%3D~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded event handler in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-84738-01": {"ajax_action": "AFTC_import_demo_data", "conditions": [{"name": "FILES:content_file:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-84738", "description": "AF Companion <2.2.0 unrestricted file upload via content_file parameter in AFTC_import_demo_data AJAX handler leads to RCE", "mode": "block", "slug": "af-companion", "target": "plugin", "versions": "<2.2.0"}, "RULE-CVE-2026-84738-02": {"ajax_action": "AFTC_import_demo_data", "conditions": [{"name": "FILES:widget_file:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-84738", "description": "AF Companion <2.2.0 unrestricted file upload via widget_file parameter in AFTC_import_demo_data AJAX handler leads to RCE", "mode": "block", "slug": "af-companion", "target": "plugin", "versions": "<2.2.0"}, "RULE-CVE-2026-84738-03": {"ajax_action": "AFTC_import_demo_data", "conditions": [{"name": "FILES:customizer_file:name", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-84738", "description": "AF Companion <2.2.0 unrestricted file upload via customizer_file parameter in AFTC_import_demo_data AJAX handler leads to RCE", "mode": "block", "slug": "af-companion", "target": "plugin", "versions": "<2.2.0"}, "RULE-CVE-2026-84752-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rtmhub_callback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-84752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84752", "description": "RTMKit (Rometheme for Elementor) <=2.1.5 missing authorization on connector callback exchange (admin-post rtmhub_callback) enabling contributor-level PHP Object Injection chain", "mode": "block", "severity": 8.8, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "object-injection", "authenticated"], "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2026-84753-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[^\\"]*\\":[0-9]+:{~"}], "cve": "CVE-2026-84753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84753", "description": "Mail Mint <=1.31.0 unauthenticated PHP object injection via untrusted unserialize() call (sink file/line and reaching entrypoint not attributed in available evidence; hardened in 1.31.1)", "mode": "block", "severity": 9.8, "slug": "mail-mint", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.31.0"}, "RULE-CVE-2026-84759-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:/dateshow|capshow|usershow|typeshow|showaction|sourceshow/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-84759", "description": "Activity Log <=2.13.1 CSRF-induced reflected XSS via unsanitized admin page filter parameters (dateshow/capshow/usershow/typeshow/showaction/sourceshow)", "mode": "block", "slug": "aryo-activity-log", "target": "plugin", "versions": "<=2.13.1"}, "RULE-CVE-2026-84761-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/litespeed/v3/err_domains[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/main_domain|alias/", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|sftp|ldap|php|expect|jar|s3|glusterfs)://|^(?:https?://)?(?:127\\\\.0\\\\.0\\\\.1|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|\\\\[::1\\\\]|\\\\[fd[0-9a-f]{2}:))~i"}], "cve": "CVE-2026-84761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84761", "description": "LiteSpeed Cache <=7.9 unauthenticated SSRF via err_domains REST callback main_domain/alias parameters (is_from_cloud IP check bypass)", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["ssrf", "unauthenticated", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<=7.9"}, "RULE-CVE-2026-84761-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/litespeed/v3/err_domains[\\\\\\\\/]*$~i"}, {"name": "ARGS:/main_domain|alias/", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|sftp|ldap|php|expect|jar|s3|glusterfs)://|^(?:https?://)?(?:127\\\\.0\\\\.0\\\\.1|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}|\\\\[::1\\\\]|\\\\[fd[0-9a-f]{2}:))~i"}], "cve": "CVE-2026-84761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84761", "description": "LiteSpeed Cache <=7.9 unauthenticated SSRF via err_domains REST callback main_domain/alias parameters (is_from_cloud IP check bypass)", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["ssrf", "unauthenticated", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<=7.9"}, "RULE-CVE-2026-84763-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:installed_template", "type": "regex", "value": "~(?:(?:javascript|data|vbscript)\\\\s*:|<\\\\/?script[\\\\s>/]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-84763", "description": "RTMKit (rometheme-for-elementor) <=2.1.5 unauthenticated reflected XSS via installed_template parameter on admin template view", "mode": "block", "slug": "rometheme-for-elementor", "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2026-84774-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:utm_campaign", "type": "regex", "value": "~(?:<(?:script|img|svg|iframe|body|input)[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-84774", "description": "WP Statistics <=14.16.11 unauthenticated reflected XSS via utm_campaign parameter rendered in admin report/metabox campaign tooltip", "mode": "block", "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.11"}, "RULE-CVE-2026-84813-01": {"action": "init", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT|\'\\\\s*(?:OR|AND|UNION)\\\\b|(?:OR|AND)(?:/\\\\*.*?\\\\*/|\\\\s)+[0-9]+\\\\s*=\\\\s*[0-9]+|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2026-84813", "description": "GeoDirectory <=2.8.174 unauthenticated SQL injection via POST email parameter in comment review-count filter", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.174"}, "RULE-CVE-2026-84820-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "view"}, {"name": "ARGS:page", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-84820", "description": "Unlimited Elements For Elementor <2.0.18 unauthenticated-delivery reflected XSS via page parameter in form entry admin footer view", "mode": "block", "slug": "unlimited-elements-for-elementor", "target": "plugin", "versions": "<2.0.18"}, "RULE-CVE-2026-84829-01": {"ajax_action": "optml_fetch_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-84829", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84829", "description": "Optimole <4.2.12 authenticated information disclosure via optml_fetch_logs AJAX handler missing capability check (deterministically evidenced authorization gap; documented unauthenticated srcset-attribute XSS path remains unlocalized in available artefacts)", "mode": "block", "severity": 8.8, "slug": "optimole-wp", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<4.2.12"}, "RULE-CVE-2026-84909-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[custom-twitter-feeds\\\\b[^\\\\]]{0,500}?(?:buttoncolor|buttontextcolor|buttontext)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).){0,200}?(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|</style|[{};])~i"}], "cve": "CVE-2026-84909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84909", "description": "Custom Twitter Feeds <=2.8.0 authenticated (contributor+) stored XSS via buttoncolor/buttontextcolor/buttontext legacy shortcode attributes", "mode": "block", "severity": 6.4, "slug": "custom-twitter-feeds", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2026-8494-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-8494-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through REST API /wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-85017-01": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-85017", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85017", "description": "Unlimited Elements For Elementor <2.0.20 missing capability check on unitecreator_elementor_import_template AJAX action allows subscriber+ PHP object injection via deserialized template data", "mode": "block", "severity": 7.5, "slug": "unlimited-elements-for-elementor", "tags": ["missing-authorization", "object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<2.0.20"}, "RULE-CVE-2026-85116-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/|/wp-login\\\\.php|/wp-cron\\\\.php|/xmlrpc\\\\.php).*$~i"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[[a-zA-Z_][a-zA-Z0-9_-]*\\\\s+[a-zA-Z_][a-zA-Z0-9_-]*\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*[\\"\'][^\\\\]]*\\\\]~"}], "cve": "CVE-2026-85116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85116", "description": "Simple CAPTCHA with Cloudflare Turnstile >=1.2.2 <1.42.3 unauthenticated arbitrary shortcode execution via do_shortcode() over rendered Contact Form 7 content", "mode": "block", "severity": 6.5, "slug": "simple-cloudflare-turnstile", "tags": ["shortcode-injection", "unauthenticated", "injection"], "target": "plugin", "versions": ">=1.2.2 <1.42.3"}, "RULE-CVE-2026-85130-01": {"ajax_action": "gdpr_log_consent_action", "conditions": [{"name": "ARGS:/subSiteId|currentSite|gdpr_user_action|cookie_list|consent_forward/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|</script|document\\\\.(?:cookie|write|location)|window\\\\.(?:location|open)|[\\"\'`]\\\\s*[;)]\\\\s*(?:alert|eval|document|window|javascript))~i"}], "cve": "CVE-2026-85130", "description": "WPLP Cookie Consent <4.4.4 unauthenticated stored XSS via gdpr_log_consent_action consent-log fields (multisite only)", "mode": "block", "severity": 8.8, "slug": "gdpr-cookie-consent", "target": "plugin", "versions": "<4.4.4"}, "RULE-CVE-2026-85414-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~custom_settings\\\\s*=\\\\s*[\'\\"]?[^\'\\"><]*(?:<script[^>]*>|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|&(?:lt|#x3c|#60);)~i"}], "cve": "CVE-2026-85414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85414", "description": "FooGallery <=3.3.2 contributor+ stored XSS via custom_settings shortcode attribute in post content", "mode": "block", "severity": 6.4, "slug": "foogallery", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-85530-01": {"ajax_action": "give_confirm_email_for_donations_access", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:<[^>]*>|[\\\\x00-\\\\x1F]|[ ]{2,})~"}], "cve": "CVE-2026-85530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85530", "description": "GiveWP <4.16.8.1 unauthenticated donor identity resolution mismatch via anomalous email parameter in give_confirm_email_for_donations_access enabling account takeover", "mode": "block", "severity": 8.1, "slug": "give", "tags": ["privilege-escalation", "unauthenticated", "improper-authorization", "account-takeover"], "target": "plugin", "versions": "<4.16.8.1"}, "RULE-CVE-2026-85574-01": {"action": "admin_post_set_unbounce_domains", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-85574", "description": "Unbounce Landing Pages >=1.1.1 <1.1.5 missing authorization on set_unbounce_domains allows subscriber+ reverse-proxy target hijack", "mode": "block", "slug": "unbounce", "target": "plugin", "versions": ">=1.1.1 <1.1.5"}, "RULE-CVE-2026-85574-02": {"action": "admin_post_flush_unbounce_pages", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-85574", "description": "Unbounce Landing Pages >=1.1.1 <1.1.5 missing authorization on flush_unbounce_pages allows subscriber+ unauthorized cache state change", "mode": "block", "slug": "unbounce", "target": "plugin", "versions": ">=1.1.1 <1.1.5"}, "RULE-CVE-2026-85652-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~album_id\\\\s*=\\\\s*(?:\\"|&quot;|\')[^\\"\'\\\\]]*?(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*.*?\\\\*/|--\\\\s|#)~i"}], "cve": "CVE-2026-85652", "description": "Photo Gallery by 10Web <=1.8.44 author+ stored time-based SQL injection via album_id shortcode attribute", "mode": "block", "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.44"}, "RULE-CVE-2026-85658-01": {"ajax_action": "pp_ajax_editprofile", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[[a-zA-Z][a-zA-Z0-9_-]{1,30}(?:\\\\s+[a-zA-Z_][a-zA-Z0-9_-]*\\\\s*=\\\\s*(?:\\"[^\\"]*\\"|\'[^\']*\'))+\\\\s*/?\\\\]~i"}], "cve": "CVE-2026-85658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85658", "description": "ProfilePress (wp-user-avatar) <=4.17.2 authenticated (subscriber+) arbitrary shortcode execution via pp_ajax_editprofile AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-user-avatar", "tags": ["code-injection", "shortcode-execution", "authenticated"], "target": "plugin", "versions": "<=4.17.2"}, "RULE-CVE-2026-85680-01": {"action": "um_submit_form_profile", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&lt;\\\\s*(?:script|svg|iframe|img)|&#0*60;|&#x0*3c;)~i"}], "cve": "CVE-2026-85680", "description": "Ultimate Member <2.13.1 unauthenticated stored XSS via profile name fields processed by um_convert_tags() during profile submission", "mode": "block", "slug": "ultimate-member", "target": "plugin", "versions": "<2.13.1"}, "RULE-CVE-2026-8623-01": {"ajax_action": "hidedflipRating", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8623", "description": "DearFlip - PDF Flipbook, 3D Flipbook <=2.4.30 missing authorization on hidedflipRating AJAX handler allows any authenticated user to modify plugin option", "mode": "block", "severity": 6.4, "slug": "3d-flipbook-dflip-lite", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.30"}, "RULE-CVE-2026-8625-01": {"ajax_action": "hidedflipRating", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8625", "description": "DearFlip PDF Flipbook <=2.4.30 missing authorization on hidedflipRating AJAX action", "mode": "block", "severity": 6.4, "slug": "3d-flipbook-dflip-lite", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.30"}, "RULE-CVE-2026-86311-01": {"ajax_action": "shortcode_bwg", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*>\\\\s*<|[\\"\']\\\\s*\\\\)\\\\s*;)~i"}], "cve": "CVE-2026-86311", "description": "Photo Gallery by 10Web <=1.8.44 Author+ stored XSS via shortcode attribute values submitted to the shortcode_bwg AJAX handler", "mode": "block", "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.44"}, "RULE-CVE-2026-86406-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_~i"}, {"name": "ARGS:current_membership_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-86406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-86406", "description": "User Registration & Membership >=4.4.6 <5.2.8 privilege escalation via unauthorized membership purchase AJAX family lacking capability and payment/plan validation", "mode": "block", "severity": 7.5, "slug": "user-registration", "tags": ["privilege-escalation", "missing-authorization", "authenticated"], "target": "plugin", "versions": ">=4.4.6 <5.2.8"}, "RULE-CVE-2026-86444-01": {"action": "init", "conditions": [{"name": "ARGS:lp-order-received", "type": "exists"}, {"name": "ARGS:key", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\'<>])~i"}], "cve": "CVE-2026-86444", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-86444", "description": "LearnPress <4.4.7 unauthenticated reflected XSS via key parameter on public order-received page", "mode": "block", "severity": 7.1, "slug": "learnpress", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<4.4.7"}, "RULE-CVE-2026-86583-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:/display_name|nickname/", "type": "regex", "value": "~\\\\\\\\+$~"}], "cve": "CVE-2026-86583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-86583", "description": "Import and export users and customers <=2.4.17 privilege escalation via CSV escape-character desync in display_name/nickname profile fields", "mode": "block", "severity": 8.8, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "csv-injection", "authenticated"], "target": "plugin", "versions": "<=2.4.17"}, "RULE-CVE-2026-8705-01": {"ajax_action": "clearsale_total_push", "conditions": [{"name": "ARGS:pagseguro[metodo]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|IF)\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|\\\\bOR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|/\\\\*[^*]*\\\\*/|\\\\bAND\\\\s+\\\\(\\\\s*SELECT\\\\b)~i"}], "cve": "CVE-2026-8705", "description": "ClearSale Total <=3.4.2 unauthenticated SQL injection via pagseguro[metodo] in clearsale_total_push AJAX handler", "mode": "block", "severity": 7.5, "slug": "clearsale-total", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2026-87067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/xmlrpc\\\\.php~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-87067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87067", "description": "Forminator Forms <1.57.2.1 authenticated PHP object injection via unrestricted class instantiation during XML-RPC request deserialization", "mode": "block", "severity": 8.5, "slug": "forminator", "tags": ["object-injection", "deserialization", "xmlrpc", "remote-code-execution"], "target": "plugin", "versions": "<1.57.2.1"}, "RULE-CVE-2026-87068-01": {"ajax_action": "forminator_save_import_quiz_popup", "conditions": [{"name": "ARGS:importable", "type": "regex", "value": "~\\"(?:user_role|default_role|assigned_role|new_user_role|role)\\"\\\\s*:\\\\s*\\"(?:administrator|editor|author|shop_manager)\\"~i"}], "cve": "CVE-2026-87068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87068", "description": "Forminator Forms >=1.57.0 <1.57.2.1 authenticated privilege escalation via unvalidated registration role in imported quiz (forminator_save_import_quiz_popup)", "mode": "block", "severity": 8.8, "slug": "forminator", "tags": ["privilege-escalation", "authenticated", "role-manipulation"], "target": "plugin", "versions": ">=1.57.0 <1.57.2.1"}, "RULE-CVE-2026-8719-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/tools(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP tool enumeration via REST API allows low-privilege users to list admin-level tools", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8719-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp-oauth(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP OAuth authorization allows non-admin users to authorize MCP applications", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8761-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/dokan/v1/customers[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-8761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8761", "description": "Dokan (dokan-lite) <=5.0.1 privilege escalation via vendor-only permission check on re-registered dokan/v1/customers REST route", "mode": "block", "severity": 8.8, "slug": "dokan-lite", "tags": ["missing-authorization", "privilege-escalation", "idor", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-8761-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/dokan/v1/customers[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-8761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8761", "description": "Dokan (dokan-lite) <=5.0.1 privilege escalation via vendor-only permission check on re-registered dokan/v1/customers REST route", "mode": "block", "severity": 8.8, "slug": "dokan-lite", "tags": ["missing-authorization", "privilege-escalation", "idor", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-87902-01": {"action": "init", "conditions": [{"name": "ARGS:pagename", "type": "regex", "value": "~(?:\\\\.|%2e|%252e){2}(?:/|\\\\\\\\|%2f|%5c|%252f|%255c)~i"}], "cve": "CVE-2026-87902", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "description": "Unauthenticated path traversal in WordPress core page-template resolution leading to conditional local file inclusion / RCE (GHSA-7hp8-65ch-5whp, CVSS 9.2). get_page_template() in wp-includes/template.php urldecodes the pagename query var and, when the decoded value differs from the raw value, appends the candidate template page-{pagename_decoded}.php WITHOUT calling validate_file(); locate_template() then resolves that name against the active theme directory and includes it, so a decoded value carrying ../ climbs out of the theme. When the active theme has a top-level directory whose name starts with page- (e.g. page-templates in Twenty Twelve/Fourteen, Neve, Hestia, Sydney) the page- prefix and the trailing .php are consumed by the traversal, allowing inclusion of any readable local .php (pearcmd.php gives RCE where register_argc_argv=On). Reaching the branch requires the query var to still contain a percent sign after WordPress\' own decode, so the traversal is double URL-encoded on the wire. Fixed across all branches at 7.1.2 / 7.0.6 / 6.9.9 / 6.8.10 / ... / 4.7.37 by guarding the decoded branch with validate_file() and constraining locate_template() to the theme directories. This rule matches encoded or literal directory traversal in the pagename argument.", "mode": "block", "severity": 9.2, "tags": ["path-traversal", "lfi", "rce", "wp-core", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.2"}, "RULE-CVE-2026-87902-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]pagename=[^&#]*(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e(?:%2f|%5c))~i"}], "cve": "CVE-2026-87902", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "description": "Unauthenticated path traversal in WordPress core page-template resolution leading to conditional local file inclusion / RCE (GHSA-7hp8-65ch-5whp, CVSS 9.2). get_page_template() in wp-includes/template.php urldecodes the pagename query var and, when the decoded value differs from the raw value, appends the candidate template page-{pagename_decoded}.php WITHOUT calling validate_file(); locate_template() then resolves that name against the active theme directory and includes it, so a decoded value carrying ../ climbs out of the theme. When the active theme has a top-level directory whose name starts with page- (e.g. page-templates in Twenty Twelve/Fourteen, Neve, Hestia, Sydney) the page- prefix and the trailing .php are consumed by the traversal, allowing inclusion of any readable local .php (pearcmd.php gives RCE where register_argc_argv=On). Reaching the branch requires the query var to still contain a percent sign after WordPress\' own decode, so the traversal is double URL-encoded on the wire. Fixed across all branches at 7.1.2 / 7.0.6 / 6.9.9 / 6.8.10 / ... / 4.7.37 by guarding the decoded branch with validate_file() and constraining locate_template() to the theme directories. Defence-in-depth carrier: the engine double-decodes REQUEST_URI, so the fully decoded ../ traversal in the pagename carrier is visible even when the argument-level view is still single-encoded. This rule matches a decoded directory-traversal sequence in the pagename request carrier.", "mode": "block", "severity": 9.2, "tags": ["path-traversal", "lfi", "rce", "wp-core", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.2"}, "RULE-CVE-2026-87915-01": {"ajax_action": "pum_sub_form", "conditions": [{"name": "ARGS:values[/.+/]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|mouseout)\\\\s*=|javascript\\\\s*:|&#(?:0*106|x0*6a);?)~i"}], "cve": "CVE-2026-87915", "description": "Popup Maker <=1.24.0 unauthenticated stored XSS via values[] array parameter in pum_sub_form AJAX handler", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<=1.24.0"}, "RULE-CVE-2026-87917-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mc4wp/v1/form[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS", "type": "regex", "value": "~\\\\b(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2026-87917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87917", "description": "MC4WP Mailchimp for WordPress <=4.14.0 unauthenticated reflected XSS via disallowed URL protocol in \'data\' dynamic content tag rendered by the public /mc4wp/v1/form REST endpoint", "mode": "block", "severity": 6.1, "slug": "mailchimp-for-wp", "tags": ["xss", "reflected", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.14.0"}, "RULE-CVE-2026-87917-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mc4wp/v1/form[\\\\\\\\/]*$~i"}, {"name": "ARGS", "type": "regex", "value": "~\\\\b(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2026-87917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-87917", "description": "MC4WP Mailchimp for WordPress <=4.14.0 unauthenticated reflected XSS via disallowed URL protocol in \'data\' dynamic content tag rendered by the public /mc4wp/v1/form REST endpoint", "mode": "block", "severity": 6.1, "slug": "mailchimp-for-wp", "tags": ["xss", "reflected", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.14.0"}, "RULE-CVE-2026-8809-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_post_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~^administrator$~i"}], "cve": "CVE-2026-8809", "description": "ACF Extended <=0.9.2.5 unauthenticated privilege escalation via validation bypass in frontend form _acf_post_id parameter", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.5"}, "RULE-CVE-2026-8848-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pum/v1/connect/install(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8848", "description": "Popup Maker <=1.22.0 missing authorization on REST connect/install endpoint allows editor-level users to install and activate an arbitrary plugin from an attacker-controlled URL, leading to remote code execution", "mode": "block", "severity": 7.2, "slug": "popup-maker", "target": "plugin", "versions": "<=1.22.0"}, "RULE-CVE-2026-8848-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pum/v1/connect/info(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8848", "description": "Popup Maker <=1.22.0 missing authorization on legacy REST connect/info endpoint allows editor-level users to obtain the bearer token later used to satisfy the install endpoint\'s only non-spoofable validation check", "mode": "block", "severity": 7.2, "slug": "popup-maker", "target": "plugin", "versions": "<=1.22.0"}, "RULE-CVE-2026-8901-01": {"ajax_action": "integrazo_fwcrm_form_errorlog_show_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8901", "description": "Integration for Freshsales <=1.0.15 stored XSS via error log - missing capability check on errorlog_show_action allows subscriber+ to trigger stored XSS payloads", "mode": "block", "severity": 7.2, "slug": "crm-integration-freshworks-any-form", "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2026-89064-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_HEADERS:Authorization", "type": "regex", "value": "~^Basic\\\\s+~i"}, {"name": "", "type": "missing_capability", "value": "ai1wm_export_site"}, {"name": "", "type": "missing_capability", "value": "ai1wm_import_site"}], "cve": "CVE-2026-89064", "description": "All-in-One WP Migration and Backup <=7.110 unauthenticated HTTP Basic credential harvesting via unguarded admin_init credential capture in Ai1wm_Main_Controller::init()", "mode": "block", "severity": 5.3, "slug": "all-in-one-wp-migration", "target": "plugin", "versions": "<=7.110"}, "RULE-CVE-2026-89080-01": {"ajax_action": "change_method_to_email", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-89080", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89080", "description": "Really Simple Security <9.8.1 missing authorization on change_method_to_email AJAX handler allows resetting another user\'s completed 2FA enrolment via user_id parameter", "mode": "block", "severity": 7.5, "slug": "really-simple-ssl", "tags": ["authentication-bypass", "missing-authorization", "two-factor-authentication", "idor"], "target": "plugin", "versions": "<9.8.1"}, "RULE-CVE-2026-89080-02": {"ajax_action": "resend_email_code_profile", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-89080", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89080", "description": "Really Simple Security <9.8.1 missing authorization on resend_email_code_profile AJAX handler allows resetting another user\'s completed 2FA enrolment via user_id parameter", "mode": "block", "severity": 7.5, "slug": "really-simple-ssl", "tags": ["authentication-bypass", "missing-authorization", "two-factor-authentication", "idor"], "target": "plugin", "versions": "<9.8.1"}, "RULE-CVE-2026-8912-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS:form_input", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-8912", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via form_input parameter in post_cg_gallery_form_upload", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-89141-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/mwai/v1/simpleTranscribeAudio[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:mediaId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-89141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89141", "description": "AI Engine <=3.7.7 IDOR via mediaId parameter on simpleTranscribeAudio REST endpoint allows subscriber-level access to other users\' private audio transcriptions", "mode": "block", "severity": 6.5, "slug": "ai-engine", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2026-89141-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/mwai/v1/simpleTranscribeAudio[\\\\\\\\/]*$~i"}, {"name": "ARGS:mediaId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-89141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89141", "description": "AI Engine <=3.7.7 IDOR via mediaId parameter on simpleTranscribeAudio REST endpoint allows subscriber-level access to other users\' private audio transcriptions", "mode": "block", "severity": 6.5, "slug": "ai-engine", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2026-89274-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[/?[a-zA-Z_][\\\\w-]*(?:\\\\s+[a-zA-Z_][\\\\w-]*\\\\s*=\\\\s*(?:\\"[^\\"]{0,200}\\"|\'[^\']{0,200}\'))+\\\\s*/?\\\\]|\\\\[[a-zA-Z_][\\\\w-]*\\\\s*/\\\\]|\\\\[/[a-zA-Z_][\\\\w-]*\\\\]~i"}], "cve": "CVE-2026-89274", "description": "WP Recipe Maker <=10.8.1 unauthenticated arbitrary shortcode execution via comment_post comment field consumed as reviewBody metadata", "mode": "block", "slug": "wp-recipe-maker", "target": "plugin", "versions": "<=10.8.1"}, "RULE-CVE-2026-89333-01": {"action": "init", "conditions": [{"name": "ARGS:student_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2026-89333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89333", "description": "Tutor LMS <=4.0.8 authenticated IDOR via student_id parameter discloses arbitrary users\' email and phone", "mode": "block", "severity": 6.5, "slug": "tutor", "tags": ["idor", "broken-access-control", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=4.0.8"}, "RULE-CVE-2026-89406-01": {"action": "init", "conditions": [{"name": "ARGS:modula_gallery_id", "type": "exists"}, {"name": "ARGS:modula_image_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-89406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-89406", "description": "Modula Image Gallery <=3.0.1 unauthenticated disclosure of private gallery/image metadata via modula_gallery_id and modula_image_id GET parameters read on wp_head", "mode": "pass", "severity": 7.5, "slug": "modula-best-grid-gallery", "tags": ["missing-authorization", "information-disclosure", "idor", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-89412-01": {"ajax_action": "trp_get_translations_domchanges", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|&lt;\\\\s*script|&#0*60;\\\\s*script|&#x0*3c;\\\\s*script|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-89412", "description": "TranslatePress <=3.3.5 unauthenticated stored XSS via trp_get_translations_domchanges seeding of Translation Memory original strings later rendered via v-html", "mode": "block", "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2026-900001-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-anything-on-click/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support / Essential Plugin supply chain attack: unauthenticated RCE via wpos-analytics REST endpoint. Compromised analytics.essentialplugin.com returns malicious serialized PHP object through unserialize() in class-anylc-admin.php, leading to arbitrary file_put_contents (dropper: wp-comments-posts.php, wp-config.php injection). Shared SDK affects 22 plugins (~200k installs). No CVE assigned; tracked as CAMPAIGN-WPOS-SUPPLY-CHAIN.", "method": "POST", "mode": "block", "severity": 10.0, "slug": "popup-anything-on-click", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "ssrf", "backdoor", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-logo-showcase-responsive-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Logo Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-logo-showcase-responsive-slider-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/countdown-timer-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Countdown Timer Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "countdown-timer-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprps-post-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Responsive Recent Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-responsive-recent-post-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-news-and-scrolling-widgets/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP News and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-news-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-slick-slider-and-image-carousel/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Slick Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-slick-slider-and-image-carousel", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/album-and-image-gallery-plus-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Album and Image Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "album-and-image-gallery-plus-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-testimonials-with-rotator-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Testimonial with Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-testimonial-with-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-09": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-blog-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Blog and Widgets plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-blog-and-widgets", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-10": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/blog-designer-post-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Blog Designer for Post and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "blog-designer-for-post-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-11": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/meta-slider-and-carousel-with-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Meta Slider and Carousel plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "meta-slider-and-carousel-with-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-12": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid-and-filter-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Post Grid and Filter Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "post-grid-and-filter-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-13": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timeline-and-history-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Timeline and History Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "timeline-and-history-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-14": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-responsive-faq-with-category-plugin/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP FAQ plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-faq", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-15": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-team-showcase-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Team Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-team-showcase-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-17": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-trending-post-slider-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Trending Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-trending-post-slider-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-18": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-post-creative/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Featured Post Creative plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "featured-post-creative", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-19": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/portfolio-and-projects/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Portfolio and Projects plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "portfolio-and-projects", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-20": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ticker-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Ticker Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "ticker-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-21": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video-gallery-and-player/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in HTML5 Video Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "html5-videogallery-plus-player", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-22": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-featured-content-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CAMPAIGN-WPOS-SUPPLY-CHAIN", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Featured Content and Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-featured-content-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-91011-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img[^>]+class=[\\"\'][^\\"\']*(?:\\\\$\\\\{?[0-9]|\\\\\\\\[0-9])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-91011", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-91011", "description": "EWWW Image Optimizer <8.7.7 Author+ stored XSS via unescaped preg_replace backreference in image class attribute during ExactDN page rewrite", "mode": "block", "severity": 6.8, "slug": "ewww-image-optimizer", "tags": ["xss", "stored", "authenticated", "preg-replace-injection"], "target": "plugin", "versions": "<8.7.7"}, "RULE-CVE-2026-9109-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|on(?:error|load|toggle|mouseover|focus|click|change)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img\\\\b[^>]+\\\\bon[a-z]~i"}], "cve": "CVE-2026-9109", "description": "GPTranslate <=2.31 unauthenticated stored XSS via REST API translation storage", "mode": "block", "severity": 7.2, "slug": "gptranslate", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2026-9125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9125-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9134-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through post editor", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9134-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through REST API", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9178-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v3/user/list/[0-9]+(?:/|\\\\?|$)~"}, {"name": "REQUEST_HEADERS:Username", "type": "exists"}], "cve": "CVE-2026-9178", "description": "WP Forms Connector <=1.8 unauthenticated sensitive user data exposure via wp/v3/user/list REST endpoint", "mode": "block", "severity": 7.5, "slug": "wp-forms-connector", "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-9179-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v3/post/list(?:[/?&]|$)~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\bCASE\\\\s+WHEN\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|--\\\\s|/\\\\*|#)~i"}], "cve": "CVE-2026-9179", "description": "WP Forms Connector <=1.8 unauthenticated SQL injection via order parameter in /wp-json/wp/v3/post/list REST endpoint", "mode": "block", "severity": 7.5, "slug": "wp-forms-connector", "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-92229-01": {"ajax_action": "forminator_load_quiz", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*\\\\]\\\\s*\\\\[|[0-9]\\\\]\\\\[)\\\\s*[a-zA-Z_][\\\\w-]*~i"}], "cve": "CVE-2026-92229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92229", "description": "Forminator <=1.57.2 unauthenticated arbitrary shortcode execution via forminator_load_quiz AJAX handler", "mode": "block", "severity": 9.1, "slug": "forminator", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.57.2"}, "RULE-CVE-2026-92229-02": {"ajax_action": "forminator_reload_quiz", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*\\\\]\\\\s*\\\\[|[0-9]\\\\]\\\\[)\\\\s*[a-zA-Z_][\\\\w-]*~i"}], "cve": "CVE-2026-92229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92229", "description": "Forminator <=1.57.2 unauthenticated arbitrary shortcode execution via forminator_reload_quiz AJAX handler", "mode": "block", "severity": 9.1, "slug": "forminator", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.57.2"}, "RULE-CVE-2026-92249-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/>]|<img[^>]+onerror)~i"}], "cve": "CVE-2026-92249", "description": "Qi Addons For Elementor <=1.11 unauthenticated reflected XSS via \'s\' search parameter reflected by Table of Contents widget heading scan on search results pages", "mode": "block", "slug": "qi-addons-for-elementor", "target": "plugin", "versions": "<=1.11"}, "RULE-CVE-2026-9243-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~carousel_direction[^}]*(?:on(?:focus|blur|mouse(?:over|enter|move|out)|click|dblclick|key(?:down|up|press)|load|error|focusin|focusout|pointerover|touchstart|animationend)\\\\s*=|style\\\\s*=\\\\s*[^\\"]*(?:position|expression))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9243", "description": "The Plus Addons for Elementor <=6.4.15 contributor+ stored XSS via carousel_direction unquoted attribute injection", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.4.15"}, "RULE-CVE-2026-92540-01": {"ajax_action": "acui_import_users_batch", "conditions": [{"name": "ARGS:form[caller_can_promote_users]", "type": "regex", "value": "~^(?:1|true|on)$~i"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-92540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92540", "description": "Import and export users and customers <2.5.2 privilege escalation to administrator via caller_can_promote_users in acui_import_users_batch AJAX handler", "mode": "block", "severity": 7.2, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "missing-authorization", "csv-import"], "target": "plugin", "versions": ">=2.4.16 <2.5.2"}, "RULE-CVE-2026-92541-01": {"ajax_action": "acui_import_users_batch", "conditions": [{"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-92541", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92541", "description": "Import and export users and customers <2.5.2 authenticated create_users role privilege escalation via acui_import_users_batch missing promote_users check", "mode": "block", "severity": 7.2, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<2.5.2"}, "RULE-CVE-2026-92619-01": {"ajax_action": "wpbc_ajax_option_save", "conditions": [{"name": "ARGS:data_name", "type": "regex", "value": "~^(?:default_role|users_can_register|siteurl|home|active_plugins|template|stylesheet|admin_email|wp_user_roles)$~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-92619", "description": "Booking Calendar <=11.8.2 privilege escalation via wpbc_ajax_option_save unrestricted core WordPress option write", "mode": "block", "slug": "booking", "target": "plugin", "versions": "<=11.8.2"}, "RULE-CVE-2026-92714-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpdm_duplicate", "type": "exists"}, {"name": "ARGS:__copynonce", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-92714", "description": "Download Manager <=3.3.68 IDOR in package duplicate() allows Contributor+ to duplicate arbitrary protected packages via wpdm_duplicate/__copynonce on admin_init", "mode": "block", "severity": 6.5, "slug": "download-manager", "target": "plugin", "versions": "<=3.3.68"}, "RULE-CVE-2026-9290-01": {"action": "init", "conditions": [{"name": "ARGS:wpum_profile", "type": "exists"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\. %2[fF]|\\\\.\\\\. %5[cC]|\\\\.\\\\. %252[fF]|%2[eE]%2[eE](?:%2[fF]|%5[cC])|%252[eE]%252[eE]%252[fF]|%00)~"}], "cve": "CVE-2026-9290", "description": "WP User Manager <=2.9.17 unauthenticated LFI via tab query parameter on profile page", "mode": "block", "severity": 7.5, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.17"}, "RULE-CVE-2026-9290-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)profile/[^/]+/(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\. %2[fF]|\\\\.\\\\. %5[cC]|\\\\.\\\\. %252[fF]|%2[eE]%2[eE](?:%2[fF]|%5[cC])|%252[eE]%252[eE]|%00)~i"}], "cve": "CVE-2026-9290", "description": "WP User Manager <=2.9.17 unauthenticated LFI via tab path segment in profile permalink", "mode": "block", "severity": 7.5, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.17"}, "RULE-CVE-2026-93485-001": {"action": "init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-93485-01", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~<blockquote\\\\b~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Permanent pass-only companion for RULE-CVE-2026-93485-01. Records blockquote markup submitted through this comment carrier, including ordinary quoted comments, to investigate zero primary hits. A monitor hit does not establish an attack. The monitor sorts before the primary so a blocking primary cannot suppress this telemetry.", "mode": "pass", "severity": 7.1, "tags": ["wp-core", "comments", "telemetry", "permanent-pass"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-002": {"action": "rest_api_init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-93485-02", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/wp/v2/comments[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Permanent pass-only companion for RULE-CVE-2026-93485-02. Records blockquote markup submitted through this comment carrier, including ordinary quoted comments, to investigate zero primary hits. A monitor hit does not establish an attack. The monitor sorts before the primary so a blocking primary cannot suppress this telemetry.", "mode": "pass", "severity": 7.1, "tags": ["wp-core", "comments", "telemetry", "permanent-pass"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-003": {"action": "rest_api_init", "block_policy": "never_block", "companion_for": "RULE-CVE-2026-93485-03", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/wp/v2/comments[\\\\\\\\/]*$~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Permanent pass-only companion for RULE-CVE-2026-93485-03. Records blockquote markup submitted through this comment carrier, including ordinary quoted comments, to investigate zero primary hits. A monitor hit does not establish an attack. The monitor sorts before the primary so a blocking primary cannot suppress this telemetry.", "mode": "pass", "severity": 7.1, "tags": ["wp-core", "comments", "telemetry", "permanent-pass"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~<blockquote\\\\b[^>\\\\r\\\\n]{0,400}[\\\\r\\\\n]~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Unauthenticated stored XSS in WordPress core comment rendering leading to conditional RCE, nicknamed Comment2Shell (CVE-2026-93485, CVSS 7.1). wpautop() in wp-includes/formatting.php unwraps a paragraph-wrapped blockquote with the regex <p><blockquote([^>]*)> whose [^>]* stops at the first greater-than character. Before that runs, wp_replace_in_html_tags() rewrites any newline that sits INSIDE an HTML tag to a placeholder that itself contains a greater-than character, so an allowlisted blockquote opening tag carrying a line break inside an attribute (such as cite) is split by the unwrap regex, relocating attacker-controlled text into live markup; wptexturize() then closes an injected event-handler attribute with autofocus, so script runs on page load for any viewer, and a logged-in administrator viewing the page can have their session used to install a plugin web shell. The construct survives wp_kses() because a newline inside a permitted tag is not something the sanitiser strips. Fixed across all branches at 7.1.1 / 7.0.5 / 6.9.8 / 6.8.9 / ... / 4.7.36 with a quote-aware wpautop() pattern. This rule matches a blockquote opening tag that contains a line break before it is closed, on the classic comment submission endpoint (/wp-comments-post.php, comment field).", "mode": "block", "severity": 7.1, "tags": ["xss", "stored-xss", "rce", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/wp/v2/comments[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b[^>\\\\r\\\\n]{0,400}[\\\\r\\\\n]~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Unauthenticated stored XSS in WordPress core comment rendering leading to conditional RCE, nicknamed Comment2Shell (CVE-2026-93485, CVSS 7.1). wpautop() in wp-includes/formatting.php unwraps a paragraph-wrapped blockquote with the regex <p><blockquote([^>]*)> whose [^>]* stops at the first greater-than character. Before that runs, wp_replace_in_html_tags() rewrites any newline that sits INSIDE an HTML tag to a placeholder that itself contains a greater-than character, so an allowlisted blockquote opening tag carrying a line break inside an attribute (such as cite) is split by the unwrap regex, relocating attacker-controlled text into live markup; wptexturize() then closes an injected event-handler attribute with autofocus, so script runs on page load for any viewer, and a logged-in administrator viewing the page can have their session used to install a plugin web shell. The construct survives wp_kses() because a newline inside a permitted tag is not something the sanitiser strips. Fixed across all branches at 7.1.1 / 7.0.5 / 6.9.8 / 6.8.9 / ... / 4.7.36 with a quote-aware wpautop() pattern. This rule matches a blockquote opening tag that contains a line break before it is closed, on the REST comment submission endpoint (/wp/v2/comments, URI carrier for pretty and rest_route forms, content field).", "mode": "block", "severity": 7.1, "tags": ["xss", "stored-xss", "rce", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93485-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/wp/v2/comments[\\\\\\\\/]*$~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<blockquote\\\\b[^>\\\\r\\\\n]{0,400}[\\\\r\\\\n]~i"}], "cve": "CVE-2026-93485", "cve_link": "https://wordpress.org/documentation/wordpress-version/version-7-1-1/", "description": "Unauthenticated stored XSS in WordPress core comment rendering leading to conditional RCE, nicknamed Comment2Shell (CVE-2026-93485, CVSS 7.1). wpautop() in wp-includes/formatting.php unwraps a paragraph-wrapped blockquote with the regex <p><blockquote([^>]*)> whose [^>]* stops at the first greater-than character. Before that runs, wp_replace_in_html_tags() rewrites any newline that sits INSIDE an HTML tag to a placeholder that itself contains a greater-than character, so an allowlisted blockquote opening tag carrying a line break inside an attribute (such as cite) is split by the unwrap regex, relocating attacker-controlled text into live markup; wptexturize() then closes an injected event-handler attribute with autofocus, so script runs on page load for any viewer, and a logged-in administrator viewing the page can have their session used to install a plugin web shell. The construct survives wp_kses() because a newline inside a permitted tag is not something the sanitiser strips. Fixed across all branches at 7.1.1 / 7.0.5 / 6.9.8 / 6.8.9 / ... / 4.7.36 with a quote-aware wpautop() pattern. This rule matches a blockquote opening tag that contains a line break before it is closed, on the REST comment submission endpoint (/wp/v2/comments, source-parsed rest_route carrier, content field).", "mode": "block", "severity": 7.1, "tags": ["xss", "stored-xss", "rce", "wp-core", "comments", "unauthenticated"], "target": "core", "versions": ">=4.7.0 <7.1.1"}, "RULE-CVE-2026-93526-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/edit\\\\.php~i"}, {"name": "ARGS:qr_checked_in", "type": "regex", "value": "~(?:[\\"\'<>]|javascript\\\\s*:|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-93526", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-93526", "description": "Event Tickets <=5.29.4 unauthenticated reflected XSS via qr_checked_in parameter reflected unescaped in QR check-in admin notice on wp-admin/edit.php", "mode": "block", "severity": 7.1, "slug": "event-tickets", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.29.4"}, "RULE-CVE-2026-93836-01": {"action": "init", "conditions": [{"name": "ARGS:woosb_ids", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-93836", "description": "WPC Product Bundles for WooCommerce <=8.6.6 unauthenticated stored XSS via woosb_ids parameter during add-to-cart/checkout", "mode": "block", "severity": 7.2, "slug": "woo-product-bundle", "target": "plugin", "versions": "<=8.6.6"}, "RULE-CVE-2026-94487-01": {"ajax_action": "pp-roles-add-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-add-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94487-02": {"ajax_action": "pp-roles-delete-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-delete-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94487-03": {"ajax_action": "pp-roles-hide-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-hide-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94487-04": {"ajax_action": "pp-roles-unhide-role", "conditions": [{"type": "missing_capability", "value": "manage_capabilities"}], "cve": "CVE-2026-94487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-94487", "description": "PublishPress Capabilities (Capability Manager Enhanced) <=2.50.1 CSRF/missing authorization on pp-roles-unhide-role AJAX action via handleRolesAjax", "mode": "block", "severity": 8.1, "slug": "capability-manager-enhanced", "tags": ["csrf", "missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.50.1"}, "RULE-CVE-2026-94500-01": {"ajax_action": "ekit_widgetarea_content", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-94500", "description": "ElementsKit Elementor addons Lite <4.0.6 reflected XSS via post_id parameter in ekit_widgetarea_content AJAX handler", "mode": "block", "slug": "elementskit-lite", "target": "plugin", "versions": "<4.0.6"}, "RULE-CVE-2026-94504-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~(?:</textarea|<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data:text/html)~i"}], "cve": "CVE-2026-94504", "description": "Ninja Forms <=3.15.3 unauthenticated stored XSS via nf_ajax_submit formData textarea value rendered unescaped in legacy submission editor", "mode": "block", "slug": "ninja-forms", "target": "plugin", "versions": "<=3.15.3"}, "RULE-CVE-2026-95515-01": {"action": "admin_init", "conditions": [{"name": "ARGS:nf-deactivated", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<body[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationend)\\\\s*=|javascript\\\\s*:|&(?:#x?[0-9a-f]+|lt|gt);)~i"}], "cve": "CVE-2026-95515", "description": "Ninja Forms <=3.15.3 unauthenticated reflected XSS via nf-deactivated parameter rendered globally through the admin_notices deactivation notice (user interaction required)", "mode": "block", "slug": "ninja-forms", "target": "plugin", "versions": "<=3.15.3"}, "RULE-CVE-2026-95522-01": {"ajax_action": "edd_get_file_download_link", "conditions": [{"name": "ARGS:/payment_id|download_id|price_id/", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-95522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-95522", "description": "Easy Digital Downloads <=3.7.0 Shop Manager SQL injection via non-numeric payment_id/download_id/price_id in edd_get_file_download_link AJAX handler", "mode": "block", "severity": 7.6, "slug": "easy-digital-downloads", "tags": ["sql-injection", "authenticated", "shop-manager", "ajax"], "target": "plugin", "versions": "<=3.7.0"}, "RULE-CVE-2026-95529-01": {"action": "init", "conditions": [{"name": "ARGS:cff_template_preview", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-95529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-95529", "description": "Calculated Fields Form <5.5.1.2 unauthenticated reflected XSS via ftpl/form_id parameters in CPCFF_TEMPLATE_PREVIEW::dispatch template preview endpoint", "mode": "block", "severity": 7.1, "slug": "calculated-fields-form", "tags": ["xss", "reflected", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<5.5.1.2"}, "RULE-CVE-2026-95601-01": {"action": "init", "conditions": [{"name": "ARGS:/aws_filter|pr_stock|type_aws/", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|--\\\\s)~i"}], "cve": "CVE-2026-95601", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-95601", "description": "Product Filter by WBW <=3.1.7 unauthenticated SQL injection via aws_filter/pr_stock/type_aws front-end filter parameters", "mode": "block", "slug": "woo-product-filter", "target": "plugin", "versions": "<=3.1.7"}, "RULE-CVE-2026-9570-01": {"action": "init", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~[\'\\"><();]|</script|\\\\\\\\x[0-9a-fA-F]{2}~i"}], "cve": "CVE-2026-9570", "description": "Taskbuilder <5.0.8 unauthenticated reflected XSS via page_no parameter in frontend shortcode inline JavaScript", "mode": "block", "severity": 7.1, "slug": "taskbuilder", "target": "plugin", "versions": "<5.0.8"}, "RULE-CVE-2026-9662-01": {"action": "init", "conditions": [{"name": "ARGS:tpf", "type": "exists"}, {"name": "ARGS:tpf", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]|(?:php|phar|data|zip|expect|glob|zlib)://)~i"}], "cve": "CVE-2026-9662", "description": "Recover Exit For WooCommerce <=1.0.3 unauthenticated LFI via tpf POST parameter in recover_exit()", "mode": "block", "severity": 8.1, "slug": "recoverexit-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2026-9702-01": {"ajax_action": "update_locker_from_typ_page", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-9702", "description": "InPost PL <1.9.1 unauthenticated parcel-locker destination update via update_locker_from_typ_page AJAX handler", "mode": "block", "severity": 7.5, "slug": "inpost-for-woocommerce", "target": "plugin", "versions": "<1.9.1"}, "RULE-CVE-2026-9702-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/inpost_pl/v1/order/update(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-9702", "description": "InPost PL <1.9.1 unauthenticated order update via REST route inpost_pl/v1/order/update with open permission_callback", "mode": "block", "severity": 7.5, "slug": "inpost-for-woocommerce", "target": "plugin", "versions": "<1.9.1"}, "RULE-CVE-2026-9860-01": {"ajax_action": "cf_images_do_setup", "conditions": [{"name": "ARGS:account-id", "type": "regex", "value": "~[\'\\"]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-9860", "description": "Offload, AI & Optimize with Cloudflare Images <=1.10.2 authenticated (Author+) RCE via single-quote injection in account-id parameter written to wp-config.php", "mode": "block", "severity": 8.8, "slug": "cf-images", "target": "plugin", "versions": "<=1.10.2"}, "RULE-CVE-2026-9860-02": {"ajax_action": "cf_images_do_setup", "conditions": [{"name": "ARGS:api-key", "type": "regex", "value": "~[\'\\"]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-9860", "description": "Offload, AI & Optimize with Cloudflare Images <=1.10.2 authenticated (Author+) RCE via single-quote injection in api-key parameter written to wp-config.php", "mode": "block", "severity": 8.8, "slug": "cf-images", "target": "plugin", "versions": "<=1.10.2"}, "RULE-WPT-2453-01": {"action": "init", "conditions": [{"name": "ARGS:_chk", "type": "exists"}], "cve": "WPT-2453", "description": "Block Smart Slider 3 Pro 3.5.1.35 supply chain backdoor activation via _chk parameter. The compromised release uses this hidden parameter to receive base64-encoded PHP payloads for remote code execution.", "mode": "block", "severity": 10, "slug": "nextend-smart-slider3-pro", "tags": ["supply-chain", "backdoor", "rce", "unauthenticated"], "target": "plugin", "versions": "3.5.1.35"}, "RULE-WPT-2587-01": {"ajax_action": "sendForm", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "forms"}, {"name": "ARGS_NAMES", "type": "regex", "value": "~^fields\\\\[(?:FIELD_[A-Za-z0-9_-]+)\\\\]$~i"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\']\\\\s*on(?:abort|afterprint|animation(?:cancel|end|iteration|start)|auxclick|before(?:input|match|print|toggle|unload)|blur|cancel|canplay(?:through)?|change|click|close|contextmenu|copy|cuechange|cut|dblclick|drag(?:end|enter|leave|over|start)?|drop|durationchange|emptied|ended|error|focus(?:in|out)?|formdata|hashchange|input|invalid|key(?:down|press|up)|load(?:eddata|edmetadata|start)?|message|mouse(?:down|enter|leave|move|out|over|up|wheel)|offline|online|page(?:hide|show)|paste|pause|play(?:ing)?|pointer(?:cancel|down|enter|leave|move|out|over|up)|popstate|progress|ratechange|reset|resize|scroll(?:end)?|securitypolicyviolation|seek(?:ed|ing)|select|slotchange|stalled|storage|submit|suspend|timeupdate|toggle|touch(?:cancel|end|move|start)|transition(?:cancel|end|run|start)|unload|volumechange|waiting|wheel)\\\\s*=~i"}], "cve": "WPT-2587", "description": "AI Copilot Content Generator form submission hardening", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ai-copilot-content-generator", "tags": ["xss", "stored-xss", "zero-day"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-WPT-2815-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/wc-admin/onboarding/themes/install[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "install_themes"}], "cve": "WPT-2815", "description": "WooCommerce onboarding theme-install authorization boundary (install_themes), fixed in 11.0.1", "mode": "block", "slug": "woocommerce", "tags": ["woocommerce", "missing-authorization", "rest-api"], "target": "plugin", "versions": ">=6.5.0 <=11.0.0"}, "TEST-HEARTBEAT": {"action": "init", "conditions": [{"type": "probabilistic", "value": "0.0002"}], "cve": "TEST-HEARTBEAT", "mode": "pass", "severity": 0.1, "target": "core", "versions": ">=1.0.0"}, "TEST-RULE": {"action": "init", "conditions": [{"name": "ARGS:test-rule", "type": "equals", "value": "b3d45e60-53a5-4959-b911-5178baaef7ac"}], "cve": "TEST-CVE", "mode": "block", "severity": 2.0, "target": "core", "versions": ">=1.0.0"}}}', true );<!DOCTYPE html>
<html lang="es" class="no-js">
<head>
		<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<link rel="profile" href="http://gmpg.org/xfn/11">
	<link rel="pingback" href="https://academiadeidiomasabc.com/xmlrpc.php">
	<title>Página no encontrada &#8211; Academia de Idiomas ABC</title>
<meta name='robots' content='noindex, nofollow' />
<link rel='dns-prefetch' href='//fonts.googleapis.com' />
<link rel="alternate" type="application/rss+xml" title="Academia de Idiomas ABC &raquo; Feed" href="https://academiadeidiomasabc.com/feed/" />
<link rel="alternate" type="application/rss+xml" title="Academia de Idiomas ABC &raquo; Feed de los comentarios" href="https://academiadeidiomasabc.com/comments/feed/" />
<style id='wp-img-auto-sizes-contain-inline-css' type='text/css'>
img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px}
/*# sourceURL=wp-img-auto-sizes-contain-inline-css */
</style>
<style id='wp-emoji-styles-inline-css' type='text/css'>

	img.wp-smiley, img.emoji {
		display: inline !important;
		border: none !important;
		box-shadow: none !important;
		height: 1em !important;
		width: 1em !important;
		margin: 0 0.07em !important;
		vertical-align: -0.1em !important;
		background: none !important;
		padding: 0 !important;
	}
/*# sourceURL=wp-emoji-styles-inline-css */
</style>
<style id='wp-block-library-inline-css' type='text/css'>
:root{--wp-block-synced-color:#7a00df;--wp-block-synced-color--rgb:122,0,223;--wp-bound-block-color:var(--wp-block-synced-color);--wp-editor-canvas-background:#ddd;--wp-admin-theme-color:#007cba;--wp-admin-theme-color--rgb:0,124,186;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-10--rgb:0,107,160.5;--wp-admin-theme-color-darker-20:#005a87;--wp-admin-theme-color-darker-20--rgb:0,90,135;--wp-admin-border-width-focus:2px}@media (min-resolution:192dpi){:root{--wp-admin-border-width-focus:1.5px}}.wp-element-button{cursor:pointer}:root .has-very-light-gray-background-color{background-color:#eee}:root .has-very-dark-gray-background-color{background-color:#313131}:root .has-very-light-gray-color{color:#eee}:root .has-very-dark-gray-color{color:#313131}:root .has-vivid-green-cyan-to-vivid-cyan-blue-gradient-background{background:linear-gradient(135deg,#00d084,#0693e3)}:root .has-purple-crush-gradient-background{background:linear-gradient(135deg,#34e2e4,#4721fb 50%,#ab1dfe)}:root .has-hazy-dawn-gradient-background{background:linear-gradient(135deg,#faaca8,#dad0ec)}:root .has-subdued-olive-gradient-background{background:linear-gradient(135deg,#fafae1,#67a671)}:root .has-atomic-cream-gradient-background{background:linear-gradient(135deg,#fdd79a,#004a59)}:root .has-nightshade-gradient-background{background:linear-gradient(135deg,#330968,#31cdcf)}:root .has-midnight-gradient-background{background:linear-gradient(135deg,#020381,#2874fc)}:root{--wp--preset--font-size--normal:16px;--wp--preset--font-size--huge:42px}.has-regular-font-size{font-size:1em}.has-larger-font-size{font-size:2.625em}.has-normal-font-size{font-size:var(--wp--preset--font-size--normal)}.has-huge-font-size{font-size:var(--wp--preset--font-size--huge)}.has-text-align-center{text-align:center}.has-text-align-left{text-align:left}.has-text-align-right{text-align:right}.has-fit-text{white-space:nowrap!important}#end-resizable-editor-section{display:none}.aligncenter{clear:both}.items-justified-left{justify-content:flex-start}.items-justified-center{justify-content:center}.items-justified-right{justify-content:flex-end}.items-justified-space-between{justify-content:space-between}.screen-reader-text{border:0;clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal!important}.screen-reader-text:focus{background-color:#ddd;clip-path:none;color:#444;display:block;font-size:1em;height:auto;left:5px;line-height:normal;padding:15px 23px 14px;text-decoration:none;top:5px;width:auto;z-index:100000}html :where(.has-border-color){border-style:solid}html :where([style*=border-top-color]){border-top-style:solid}html :where([style*=border-right-color]){border-right-style:solid}html :where([style*=border-bottom-color]){border-bottom-style:solid}html :where([style*=border-left-color]){border-left-style:solid}html :where([style*=border-width]){border-style:solid}html :where([style*=border-top-width]){border-top-style:solid}html :where([style*=border-right-width]){border-right-style:solid}html :where([style*=border-bottom-width]){border-bottom-style:solid}html :where([style*=border-left-width]){border-left-style:solid}html :where(img[class*=wp-image-]){height:auto;max-width:100%}:where(figure){margin:0 0 1em}html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:var(--wp-admin--admin-bar--height,0px)}@media screen and (max-width:600px){html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:0px}}

/*# sourceURL=wp-block-library-inline-css */
</style>
<style id='classic-theme-styles-inline-css' type='text/css'>
/*! This file is auto-generated */
.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}
/*# sourceURL=/wp-includes/css/classic-themes.min.css */
</style>
<style id='global-styles-inline-css' type='text/css'>
:root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgb(6,147,227) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgb(252,185,0) 0%,rgb(255,105,0) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgb(255,105,0) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgb(255, 255, 255), 6px 6px rgb(0, 0, 0);--wp--preset--shadow--crisp: 6px 6px 0px rgb(0, 0, 0);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
/*# sourceURL=global-styles-inline-css */
</style>

<link rel='stylesheet' id='linear-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/linearicons/linear.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='masterstudy-bootstrap-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/bootstrap.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='masterstudy-bootstrap-custom-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/ms-bootstrap-custom.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='font-awesome-min-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/font-awesome.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='font-icomoon-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/icomoon.fonts.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='font-icomoon-rtl-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/rtl_demo/style.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='select2-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/select2.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='fancybox-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/jquery.fancybox.min.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='animate-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/animate.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/styles.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm-stm_layout_styles-language_center-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/vc_modules/stm_layout_styles/language_center.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles_animation-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/animation.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm-headers-header_default-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/vc_modules/headers/header_default.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm-headers_transparent-header_default_transparent-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/vc_modules/headers_transparent/header_default_transparent.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_style-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/style.css?ver=4.8.9' type='text/css' media='all' />
<style id='stm_theme_style-inline-css' type='text/css'>

			body .ms_lms_loader {
			border-color: #eab830 #eab830 transparent transparent;
			}
			body .ms_lms_loader::after, .ms_lms_loader::before {
			border-color:  transparent transparent #48a7d4 #48a7d4;
			}
@media (max-width: 1025px) {
	    #header .header_top .stm_header_top_toggler {
	     display: none !important;
	    }
	}
@media (max-width: 1025px) {
	    #header .mobile_search_courses {
	     display: none !important;
	    }
	}
/*# sourceURL=stm_theme_style-inline-css */
</style>
<link rel='stylesheet' id='stm_theme_custom_styles-css' href='https://academiadeidiomasabc.com/wp-content/uploads/stm_lms_styles/custom_styles.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles_dynamic-css' href='https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/css/dynamic.css?ver=4.8.9' type='text/css' media='all' />
<link rel='stylesheet' id='stm_theme_styles_fonts-css' href='//fonts.googleapis.com/css?family=Montserrat%7COpen+Sans%3A200%2C300%2C300italic%2C400%2C400italic%2C500%2C600%2C700%26subset%3Dlatin%2Clatin-ext&#038;ver=4.8.9' type='text/css' media='all' />
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" id="jquery-migrate-js"></script>
<link rel="https://api.w.org/" href="https://academiadeidiomasabc.com/wp-json/" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://academiadeidiomasabc.com/xmlrpc.php?rsd" />
<meta name="generator" content="WordPress 6.9.1" />
	<script>
		var ajaxurl = 'https://academiadeidiomasabc.com/wp-admin/admin-ajax.php';
		var stm_install_plugin = '02c1f7b6ca';
		var stm_buddypress_groups = '2a61f7a2d6';
		var stm_ajax_add_review = 'd2e254ee8e';
	</script>
	<link rel="shortcut icon" type="image/x-icon" href="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/favicon.ico" />
<link rel="icon" href="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-32x32.png" sizes="32x32" />
<link rel="icon" href="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-192x192.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-180x180.png" />
<meta name="msapplication-TileImage" content="https://academiadeidiomasabc.com/wp-content/uploads/2020/10/cropped-1-270x270.png" />
	</head>
<body class="error404 wp-theme-masterstudy  language_center masterstudy-theme stm_preloader_" ontouchstart="">


<!-- Searchform -->
<div class="modal fade" id="searchModal" tabindex="-1" role="dialog" aria-labelledby="searchModal">
	<div class="modal-dialog" role="document">
		<div class="modal-content">
		
			<div class="modal-body heading_font">
				<div class="search-title">Buscar</div>
				<form role="search" method="get" id="searchform" action="https://academiadeidiomasabc.com/">
				    <div class="search-wrapper">
				        <input placeholder="Escribe algo…" type="text" class="form-control search-input" value="" name="s" id="s" />
				        <button type="submit" class="search-submit" ><i class="fa fa-search"></i></button>
				    </div>
				</form>
			</div>
		
		</div>
	</div>
</div><div id="wrapper">

	
	<div id="header" class="transparent_header_off"
		data-color="">

		
		
		<div class="header_default header_default">
			<div class="container">
    <div class="row">
	    <div class="col-md-3 col-sm-12 col-xs-12">
		    <div class="logo-unit">
                	<a href="https://academiadeidiomasabc.com/"><span class="logo">Academia de Idiomas ABC</span></a>
		    </div>
		    
	        <!-- Navbar toggle MOBILE -->
		    <button type="button" class="navbar-toggle collapsed hidden-lg hidden-md" data-toggle="collapse" data-target="#header_menu_toggler">
				<span class="sr-only">Toggle navigation</span>
				<span class="icon-bar"></span>
				<span class="icon-bar"></span>
				<span class="icon-bar"></span>
			</button>
	    </div> <!-- md-3 -->
	    

	    <!-- MObile menu -->
	    <div class="col-xs-12 col-sm-12 visible-xs visible-sm">
		    <div class="collapse navbar-collapse header-menu-mobile" id="header_menu_toggler">
			    <ul class="header-menu clearfix">
				    <li id="menu-item-5090" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-5090"><a href="https://academiadeidiomasabc.com/">Inicio</a></li>
<li id="menu-item-5179" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5179"><a href="https://academiadeidiomasabc.com/courses-3/">Cursos</a>
<ul class="sub-menu">
	<li id="menu-item-5448" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5448"><a href="https://academiadeidiomasabc.com/cursos-2x1/">Cursos 2×1</a>
	<ul class="sub-menu">
		<li id="menu-item-5765" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5765"><a href="https://academiadeidiomasabc.com/2x1-ninos/">2×1 Niños</a></li>
		<li id="menu-item-5764" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5764"><a href="https://academiadeidiomasabc.com/2x1-adultos-y-adolescentes/">2×1 Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li id="menu-item-5217" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5217"><a href="https://academiadeidiomasabc.com/cursos-ingles/">Cursos de Inglés</a>
	<ul class="sub-menu">
		<li id="menu-item-5794" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5794"><a href="https://academiadeidiomasabc.com/ingles-de-ninos/">Inglés de Niños</a></li>
		<li id="menu-item-5793" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5793"><a href="https://academiadeidiomasabc.com/ingles-de-adultos-y-adolescentes/">Inglés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li id="menu-item-5216" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5216"><a href="https://academiadeidiomasabc.com/cursos-frances/">Cursos de Francés</a>
	<ul class="sub-menu">
		<li id="menu-item-5792" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5792"><a href="https://academiadeidiomasabc.com/frances-de-ninos/">Francés de Niños</a></li>
		<li id="menu-item-5791" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5791"><a href="https://academiadeidiomasabc.com/frances-de-adultos-y-adolescentes/">Francés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li id="menu-item-5369" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-5369"><a href="https://academiadeidiomasabc.com/contact-us-2/">Prueba tus conocimientos</a></li>
</ul>
</li>
<li id="menu-item-5091" class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-5091"><a href="https://academiadeidiomasabc.com/blog/">Blog ABC</a></li>
<li id="menu-item-5092" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://academiadeidiomasabc.com/about-us-2/">Acerca de Nosotros</a></li>
<li id="menu-item-5093" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5093"><a href="https://academiadeidiomasabc.com/contact-us-2/">Contáctanos</a></li>
                    <li>
                    	<form role="search" method="get" id="searchform-mobile" action="https://academiadeidiomasabc.com/">
						    <div class="search-wrapper">
						        <input placeholder="Buscar..." type="text" class="form-control search-input" value="" name="s" />
						        <button type="submit" class="search-submit" ><i class="fa fa-search"></i></button>
						    </div>
						</form>
                    </li>
			    </ul>
		    </div>
	    </div>
	    
	    <!-- Desktop menu -->
	    <div class="col-md-9 col-sm-9 col-sm-offset-0 hidden-xs hidden-sm">
			
<div class="stm_menu_toggler" data-text="Menú"></div>
<div class="header_main_menu_wrapper clearfix" style="margin-top:5px;">

    <div class="pull-right hidden-xs right_buttons">

		
		            <div class="search-toggler-unit">
                <div class="search-toggler" data-toggle="modal" data-target="#searchModal"><i class="fa fa-search"></i>
                </div>
            </div>
		
					<div class="pull-right">
    <div class="header_top_bar_socs">
        <ul class="clearfix">
                    </ul>
    </div>
</div>		
            </div>

    <div class="collapse navbar-collapse pull-right">
        <ul class="header-menu clearfix">
			<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-5090"><a href="https://academiadeidiomasabc.com/">Inicio</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5179"><a href="https://academiadeidiomasabc.com/courses-3/">Cursos</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5448"><a href="https://academiadeidiomasabc.com/cursos-2x1/">Cursos 2×1</a>
	<ul class="sub-menu">
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5765"><a href="https://academiadeidiomasabc.com/2x1-ninos/">2×1 Niños</a></li>
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5764"><a href="https://academiadeidiomasabc.com/2x1-adultos-y-adolescentes/">2×1 Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5217"><a href="https://academiadeidiomasabc.com/cursos-ingles/">Cursos de Inglés</a>
	<ul class="sub-menu">
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5794"><a href="https://academiadeidiomasabc.com/ingles-de-ninos/">Inglés de Niños</a></li>
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5793"><a href="https://academiadeidiomasabc.com/ingles-de-adultos-y-adolescentes/">Inglés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5216"><a href="https://academiadeidiomasabc.com/cursos-frances/">Cursos de Francés</a>
	<ul class="sub-menu">
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5792"><a href="https://academiadeidiomasabc.com/frances-de-ninos/">Francés de Niños</a></li>
		<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5791"><a href="https://academiadeidiomasabc.com/frances-de-adultos-y-adolescentes/">Francés de Adultos y Adolescentes</a></li>
	</ul>
</li>
	<li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-5369"><a href="https://academiadeidiomasabc.com/contact-us-2/">Prueba tus conocimientos</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-5091"><a href="https://academiadeidiomasabc.com/blog/">Blog ABC</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://academiadeidiomasabc.com/about-us-2/">Acerca de Nosotros</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5093"><a href="https://academiadeidiomasabc.com/contact-us-2/">Contáctanos</a></li>
        </ul>
    </div>

</div>	    </div><!-- md-8 desk menu -->
	    
    </div> <!-- row -->
</div> <!-- container -->		</div>
	</div> <!-- id header -->
	
<div id="main">
<div class="error_page">
	<div class="container">
	    <div class="row">
	        <div class="col-md-12">
		        <div class="heading_font">
		            <div class="error_404">404</div>
		            <div class="h2">La página que estás buscando no existe.</div>
		        </div>
		        <a href="https://academiadeidiomasabc.com" class="btn btn-default">REGRESAR A LA PÁGINA PRINCIPAL</a>
	        </div>
	    </div>
	</div>
</div>

           </div>
</div>
		<footer id="footer" class="parallax-off">
			<div class="footer_wrapper">
												
				<div id="footer_copyright">
		<div class="container">
			<div class="row">
				<div class="col-md-6 col-sm-8">
					<div class="clearfix">
													<div class="pull-left">
																	<img class="footer_logo" src="http://lms.loc/unittest/wp-content/themes/masterstudy/assets/img/tmp/footer-logo2x.png" alt="Logo del pie de página"/>
															</div>
																			<div class="copyright_text">Copyright &copy; <a target="_blank" href="https://stylemixthemes.com/masterstudy/">MasterStudy</a> Theme for WordPress by <a target="_blank" href="https://www.stylemixthemes.com/">StylemixThemes</a></div>
											</div>
				</div>
				<div class="col-md-6 col-sm-4">
					<div class="clearfix">
						<div class="pull-right xs-pull-left">
																					<!-- Header top bar Socials -->
															<div class="pull-right">
									<div class="copyright_socials">
										<ul class="clearfix">
																					</ul>
									</div>
								</div>
													</div>
						<div class="pull-right xs-pull-left hidden-sm hidden-xs">
							<ul class="footer_menu heading_font clearfix">
							    						    </ul>
						</div>
					</div>
				</div>
			</div>
		</div>
	</div>
			</div>
		</footer>

        
	<script>
		var cf7_custom_image = 'https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/img/';
		var daysStr = 'Días';
		var hoursStr = 'Horas';
		var minutesStr = 'Minutos';
		var secondsStr = 'Segundos';
	</script>


	<script type="speculationrules">
{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/masterstudy/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]}
</script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/bootstrap.min.js?ver=4.8.9" id="masterstudy-bootstrap-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/vendors/jquery.fancybox.min.js?ver=4.8.9" id="fancybox-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/js/select2.full.min.js?ver=4.8.9" id="select2-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/js/custom.js?ver=4.8.9" id="stm_theme_scripts-js"></script>
<script type="text/javascript" src="https://academiadeidiomasabc.com/wp-content/themes/masterstudy/assets/js/ajax.submit.js?ver=4.8.9" id="ajaxsubmit-js"></script>
<script id="wp-emoji-settings" type="application/json">
{"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://academiadeidiomasabc.com/wp-includes/js/wp-emoji-release.min.js?ver=6.9.1"}}
</script>
<script type="module">
/* <![CDATA[ */
/*! This file is auto-generated */
const a=JSON.parse(document.getElementById("wp-emoji-settings").textContent),o=(window._wpemojiSettings=a,"wpEmojiSettingsSupports"),s=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const a=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===a[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,a){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!a(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,a){let r;const o=(r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),s=(o.textBaseline="top",o.font="600 32px Arial",{});return e.forEach(e=>{s[e]=t(o,e,n,a)}),s}function r(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}a.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),c.toString(),p.toString()].join(",")+"));",a=new Blob([e],{type:"text/javascript"});const r=new Worker(URL.createObjectURL(a),{name:"wpTestEmojiSupports"});return void(r.onmessage=e=>{i(n=e.data),r.terminate(),t(n)})}catch(e){}i(n=f(s,u,c,p))}t(n)}).then(e=>{for(const n in e)a.supports[n]=e[n],a.supports.everything=a.supports.everything&&a.supports[n],"flag"!==n&&(a.supports.everythingExceptFlag=a.supports.everythingExceptFlag&&a.supports[n]);var t;a.supports.everythingExceptFlag=a.supports.everythingExceptFlag&&!a.supports.flag,a.supports.everything||((t=a.source||{}).concatemoji?r(t.concatemoji):t.wpemoji&&t.twemoji&&(r(t.twemoji),r(t.wpemoji)))});
//# sourceURL=https://academiadeidiomasabc.com/wp-includes/js/wp-emoji-loader.min.js
/* ]]> */
</script>
	</body>
</html>