=1.1.0"}, "RULE-CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/update\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-plugin"}, {"name": "FILES:pluginzip:name", "type": "regex", "value": "~^(platformist-quadendpointer|theme-js-wpcode|framework-triappment)\\\\.zip$~i"}], "cve": "CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01", "description": "Blocks upload of known fake-plugin archives at the WordPress plugin\\ninstall endpoint. Seed slugs are confirmed malicious backdoor-dropper\\nplugins (wp_org_exists=false, shared payload generator signature) that\\ninstall further payloads when activated. Fires on the plugin upload\\nstep before the zip is extracted, preventing backdoor deployment via\\nstolen or compromised admin credentials. The slug denylist should be\\nupdated as new IOC slugs are identified via the malware research\\npipeline. This rule covers the HTTP install vector; on-disk detection\\nis handled by AiBolit recognizers via the malware-team pipeline.\\n", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["fake-plugin-install", "post-compromise", "dropper", "php-bkdr-wpplugin-mal", "admin-credential-abuse", "wpplugin1-family"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-LEARNPRESS-C-ONLY-FIELDS-SQLI-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/(courses|profile/course-tab)([/?&]|$)~i"}, {"name": "ARGS:c_only_fields", "type": "detectSQLi"}], "cve": "CAMPAIGN-2026-W18-LEARNPRESS-CFIELDS-SQLI", "description": "LearnPress \\u2014 block SQL injection attempts via the \'c_only_fields\' query\\nparameter on the REST endpoints /wp-json/learnpress/v1/courses and\\n/wp-json/learnpress/v1/profile/course-tab. The parameter is a column-name\\nprojection list; legitimate values are bare identifiers. SQL keywords or\\nfunction-call syntax in the value indicates injection.\\n", "mode": "block", "severity": 8.5, "slug": "learnpress", "tags": ["sql-injection", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=0"}, "RULE-CAMPAIGN-TRIBE-V1-EVENTS-STATUS-SQLI-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe/events/v1/events([/?&]|$)~i"}, {"name": "ARGS:status", "type": "detectSQLi"}], "cve": "CAMPAIGN-2026-W18-TRIBE-STATUS-SQLI", "description": "The Events Calendar \\u2014 block SQL injection attempts via the \'status\' query\\nparameter on the REST endpoint /wp-json/tribe/events/v1/events. Complements\\nexisting coverage for the documented \'s\' parameter SQLi (CVE-2025-9807,\\nCVE-2025-12197) and \'order\' parameter SQLi (CVE-2024-8275).\\n", "mode": "block", "severity": 8.5, "slug": "the-events-calendar", "tags": ["sql-injection", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=0"}, "RULE-CAMPAIGN-WP-EDITOR-AUTH-COOKIE-02": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.php$~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=)?~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~(?is)(?=.*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*=(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\bget_users(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?=[^;]{0,512}\\\\b(?:role|roles)\\\\b[^;]{0,512}\\\\badministrator\\\\b))(?=.*\\\\bwp_set_current_user(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*(?:\\\\[\\\\s*\\\\d+\\\\s*\\\\])?(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*->(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*ID\\\\b)(?=.*\\\\bwp_set_auth_cookie(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*(?:\\\\[\\\\s*\\\\d+\\\\s*\\\\])?(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*->(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*ID\\\\b)~"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes that select an administrator and create an authentication cookie.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "authentication-backdoor", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-WP-EDITOR-REQUEST-CALLABLE-01": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.php$~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=)?~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~(?is)(?=.*\\\\bextract(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$_(?:REQUEST|GET|POST)\\\\b)(?=.*(?:\\\\$[A-Za-z_]\\\\w*|\\\\bcall_user_func|\\\\$_(?:REQUEST|GET|POST)\\\\s*\\\\[\\\\s*[\\\\x22\\\\x27][A-Za-z_]\\\\w*[\\\\x22\\\\x27]\\\\s*\\\\]|\\\\$\\\\{\\\\s*[\\\\x22\\\\x27][A-Za-z_]\\\\w*[\\\\x22\\\\x27]\\\\s*\\\\})(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\()~"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes that extract request variables and invoke an attacker-selected PHP callable.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "php-backdoor", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-WP703-SSRF-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/[^?]*)?/wp-json/(?:wp-block-editor/v1/url-details|oembed/1\\\\.0/proxy)(?:[/?]|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:(?:192\\\\.(?:0\\\\.(?:0|2)|88\\\\.99)|198\\\\.51\\\\.100|203\\\\.0\\\\.113)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|169\\\\.254\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|100\\\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|198\\\\.(?:18|19)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(?:22[4-9]|23[0-9]|24[0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\\\\.?(?::(?:80|443|8080))?(?:[/?#]|$)~i"}], "cve": "WP-7.0.3-SSRF-SPECIAL-IPV4", "cve_link": "https://github.com/WordPress/wordpress-develop/commit/3bc03dbb7f24365cb0bceead54ccabafa65dfff6", "description": "WordPress 7.0.0 through 7.0.2 partial virtual patch for literal special-purpose IPv4 targets submitted to the URL Details and oEmbed proxy REST endpoints.", "mode": "block", "tags": ["ssrf", "rest-api", "authenticated", "wp-core", "partial-coverage"], "target": "core", "versions": ">=7.0.0 <7.0.3"}, "RULE-CAMPAIGN-WP703-SSRF-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/(?:wp-block-editor/v1/url-details|oembed/1\\\\.0/proxy)/*$~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:(?:192\\\\.(?:0\\\\.(?:0|2)|88\\\\.99)|198\\\\.51\\\\.100|203\\\\.0\\\\.113)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|169\\\\.254\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|100\\\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|198\\\\.(?:18|19)\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|(?:22[4-9]|23[0-9]|24[0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\\\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\\\\.?(?::(?:80|443|8080))?(?:[/?#]|$)~i"}], "cve": "WP-7.0.3-SSRF-SPECIAL-IPV4", "cve_link": "https://github.com/WordPress/wordpress-develop/commit/3bc03dbb7f24365cb0bceead54ccabafa65dfff6", "description": "WordPress 7.0.0 through 7.0.2 partial virtual patch for literal special-purpose IPv4 targets submitted through rest_route to URL Details and oEmbed proxy.", "mode": "block", "tags": ["ssrf", "rest-api", "authenticated", "wp-core", "partial-coverage"], "target": "core", "versions": ">=7.0.0 <7.0.3"}, "RULE-CAMPAIGN-WPMATES-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-mates\\\\.php($|\\\\?)~"}], "cve": "CAMPAIGN-WPMATES-01", "description": "Blocks requests to /wp-mates.php, a documented planted-backdoor filename\\nnot present in WordPress core or any tracked legitimate plugin or theme\\ndistribution. Any HTTP request to this path is a post-compromise callback\\nprobe from a threat actor confirming the backdoor remains reachable. The\\nfile must be removed from the filesystem and admin credentials rotated;\\nthis rule blocks the probe but does not remediate the underlying\\ncompromise.\\n", "method": "GET", "mode": "block", "severity": 9.0, "tags": ["post-compromise-probe", "dropper-survival-check", "filesystem-planted-backdoor", "core-fs-path-coverage", "wp-mates-backdoor"], "target": "core", "versions": "<=999.999.999"}, "RULE-CVE-2013-2010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~ (eval, RCE) and (include, LFI) found literally in the rendered page buffer (lib/W3/PgCache.php _parse_dynamic L1390-1400, eval L1416). Attacker content (comment/post/excerpt/trackback body) carries the literal \\"\\\\s*(?:]|<[^>]+\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-7071", "description": "Essential Blocks <=4.4.6 contributor+ stored XSS via Table of Contents block attributes", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2023-7291-01": {"ajax_action": "paytium_mollie_create_account", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-02": {"ajax_action": "paytium_mollie_create_profile", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-03": {"ajax_action": "pt_save_profile_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-04": {"ajax_action": "pt_get_mollie_profiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-05": {"ajax_action": "paytium_sw_save_api_keys", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2024-0221-01": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_new_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_new_name in addImages rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-02": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-03": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "remove_items"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages remove_items", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-deletion"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-04": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "copy"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages copy", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-copy"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-05": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "move"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages move", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-move"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-06": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_new_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_new_name in addMusic rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-07": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-08": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "remove_items"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic remove_items", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-deletion"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-09": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "copy"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic copy", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-copy"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-10": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "move"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic move", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-move"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0378-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-json/mwai(?:-ui)?/v1/(?:chats/submit|chat|simpleChatbotQuery)(?:/|\\\\?|$)~i"}, {"name": "ARGS:newMessage", "type": "regex", "value": "~<\\\\s*script\\\\b[^>]*>.*?<\\\\/\\\\s*script\\\\s*>|<[^>]+\\\\b(?:href|src)\\\\s*=\\\\s*(?:[\\"\']?)\\\\s*(?:javascript|vbscript)\\\\s*:|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=\\\\s*[\\"\']~is"}], "cve": "CVE-2024-0378", "description": "Stored XSS via AI chat message in AI Engine plugin REST API", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-0405-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/burst/v1/data/compare(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-0405", "description": "Burst Statistics <=1.5.3 authenticated SQL injection via data/compare REST endpoint", "mode": "block", "severity": 7.2, "slug": "burst-statistics", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2024-0405-02": {"ajax_action": "burst_rest_api_fallback", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-0405", "description": "Burst Statistics <=1.5.3 authenticated SQL injection via REST API fallback AJAX handler", "mode": "block", "severity": 7.2, "slug": "burst-statistics", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2024-0508-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:javascript|data)[ \\\\t]*:~i"}], "cve": "CVE-2024-0508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0508", "description": "Orbit Fox by ThemeIsle <=2.10.27 contributor+ stored XSS via Pricing Table widget link URL - Elementor AJAX save path", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.10.27"}, "RULE-CVE-2024-0508-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/(?:document/save|documents)(?:[/?]|$)~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:javascript|data)[ \\\\t]*:~i"}], "cve": "CVE-2024-0508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0508", "description": "Orbit Fox by ThemeIsle <=2.10.27 contributor+ stored XSS via Pricing Table widget link URL - Elementor REST save path", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored", "authenticated", "elementor", "rest-api"], "target": "plugin", "versions": "<=2.10.27"}, "RULE-CVE-2024-0608-01": {"ajax_action": "erp_crm_track_email_opened", "conditions": [{"name": "ARGS:email", "type": "detectSQLi"}], "cve": "CVE-2024-0608", "mode": "block", "severity": 8.8, "slug": "erp", "target": "plugin", "versions": "<=1.13.1"}, "RULE-CVE-2024-0659-01": {"action": "admin_init", "conditions": [{"name": "ARGS:edd-action", "type": "equals", "value": "tools_tab_debug_log"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-0659", "description": "Easy Digital Downloads <=3.1.5 unauthorized access to debug log tools action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "easy-digital-downloads", "tags": ["broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2024-0660-01A": {"ajax_action": "frm_save_form", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "frm_save_form"}, {"name": "ARGS:success_msg", "type": "detectXSS"}], "cve": "CVE-2024-0660", "description": "Formidable Forms <=6.7.2 CSRF-to-stored-XSS via admin-ajax frm_save_form (missing nonce validation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "tags": ["xss", "csrf", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.7.2"}, "RULE-CVE-2024-0660-01B": {"ajax_action": "frm_save_form", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "frm_save_form"}, {"name": "ARGS:custom_html", "type": "detectXSS"}], "cve": "CVE-2024-0660", "description": "Formidable Forms <=6.7.2 CSRF-to-stored-XSS via admin-ajax frm_save_form (missing nonce validation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "tags": ["xss", "csrf", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.7.2"}, "RULE-CVE-2024-0668-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^advanced_db_cleaner~"}, {"name": "ARGS:aDBc_cron_elements", "type": "regex", "value": "~(?:^|%[0-9A-Fa-f]{2}|[&=\\\\[\\\\]\\"\'])[OCa]\\\\s*(?::|%3[Aa])\\\\s*[0-9]+\\\\s*(?::|%3[Aa])~"}], "cve": "CVE-2024-0668", "description": "Advanced Database Cleaner <=3.1.3 authenticated PHP object injection via process_bulk_action unserialize of aDBc_cron_elements on plugin admin page", "mode": "block", "severity": 7.2, "slug": "advanced-database-cleaner", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2024-0668-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^advanced_db_cleaner~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"[A-Za-z_\\\\\\\\][A-Za-z0-9_\\\\\\\\]*\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-0668", "description": "Advanced Database Cleaner <=3.1.3 PHP object injection payload in any plugin admin POST parameter via bulk action serialized object marker", "mode": "block", "severity": 7.2, "slug": "advanced-database-cleaner", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2024-0685-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:wp-privacy-export-personal-data|remove_personal_data)$~"}, {"name": "ARGS:email_address", "type": "regex", "value": "~(?:\'|%27|\\\\\\\\\')(?:[^@]{0,80})(?:(?:/\\\\*|%2F\\\\*)|(?:\\\\s|%20|\\\\+)(?:OR|AND|UNION)(?:\\\\s|%20|\\\\+|\\\\()|(?:--|%2D%2D|#|%23)|;|\\\\|\\\\||!=)~i"}], "cve": "CVE-2024-0685", "description": "Ninja Forms <=3.7.1 SQLi metacharacters in email_address on WP privacy export trigger reaching get_subs_by_email", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.7.1"}, "RULE-CVE-2024-0699-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php(?:[0-9s]?|t|tm)?|pht|phtml|phar|shtml|asp|aspx|jsp|cgi)(?:[?#]|$)~i"}], "cve": "CVE-2024-0699", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-0699-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://169\\\\.254\\\\.169\\\\.254(?:[/:?#]|$)~i"}], "cve": "CVE-2024-0699", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-0709-01A": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0709-01B0": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist[0]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0709-01B1": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist[1]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0786-01": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:conditionData", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via conditionData in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-02": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:valueData", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via valueData in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-03": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:exclude", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via exclude in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-04": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via include in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-05": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:productArray", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via productArray in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0825-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vimeography/v1/galleries/\\\\d+/duplicate(/|\\\\?|$)~"}, {"name": "ARGS:vimeography_duplicate_gallery_serialized", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-0825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0825", "description": "Vimeography <=2.3.2 PHP Object Injection via deserialization of untrusted input in duplicate gallery REST endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vimeography", "tags": ["object-injection", "deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2024-0852-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration)\\\\s*=|javascript:~i"}], "cve": "CVE-2024-0852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0852", "description": "coreActivity <1.8.1 unauthenticated stored XSS via REQUEST_URI logged and displayed unescaped in admin dashboard", "method": "GET", "mode": "block", "severity": 8.8, "slug": "coreactivity", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<1.8.1"}, "RULE-CVE-2024-0852-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration)\\\\s*=|javascript:~i"}], "cve": "CVE-2024-0852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0852", "description": "coreActivity <1.8.1 unauthenticated stored XSS via search query parameter logged and displayed unescaped", "method": "GET", "mode": "block", "severity": 8.8, "slug": "coreactivity", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<1.8.1"}, "RULE-CVE-2024-0856-01": {"action": "init", "conditions": [{"name": "ARGS:cpabc_ipncheck", "type": "regex", "value": "~(?:\'[[:space:]]*(?:or|and|union|select|insert|update|delete|drop|--|#)|;[[:space:]]*(?:select|insert|update|delete|drop|--|sleep|benchmark)|--|/\\\\*|\\\\*/|[[:<:]]or[[:space:]]+[0-9]+=+[0-9]+|[[:<:]]union[[:space:]]+(?:all[[:space:]]+)?select|[[:<:]]select[[:space:]].*[[:space:]]from)~i"}], "cve": "CVE-2024-0856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0856", "description": "Appointment Booking Calendar <=1.3.82 SQL injection via cpabc_ipncheck on init", "mode": "block", "severity": 8.8, "slug": "appointment-booking-calendar", "tags": ["sql-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<1.3.83"}, "RULE-CVE-2024-0952-01": {"ajax_action": "erp_acct_get_people", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|PG_SLEEP\\\\s*\\\\(|WAITFOR\\\\s+DELAY)~i"}, {"type": "missing_capability", "value": "erp_acct_manager"}], "cve": "CVE-2024-0952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0952", "description": "WP ERP <=1.12.9 authenticated SQL injection via id parameter in erp_acct_get_people AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "erp", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.12.9"}, "RULE-CVE-2024-10002-01": {"ajax_action": "rover_idx_refresh_social", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10002", "description": "Rover IDX <=3.0.0.2905 authentication bypass to administrator via rover_idx_refresh_social AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "rover-idx", "tags": ["authentication-bypass", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=3.0.0.2905"}, "RULE-CVE-2024-10002-02": {"ajax_action": "rover_idx_social", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10002", "description": "Rover IDX <=3.0.0.2905 unauthorized social settings manipulation via rover_idx_social AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "rover-idx", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=3.0.0.2905"}, "RULE-CVE-2024-10079-01": {"ajax_action": "import_content", "conditions": [{"name": "ARGS:text", "type": "regex", "value": "~(^|[;{])\\\\s*(O|C):[0-9]+:\\"~"}], "cve": "CVE-2024-10079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10079", "description": "WP Easy Post Types <=1.4.4 PHP Object Injection via unserialize of text parameter in import_content AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-post-types", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-10124-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/vayu-site-builder(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10124", "description": "Vayu Blocks <=1.1.1 unauthenticated arbitrary plugin/theme installation via REST API /ai/v1/vayu-site-builder", "method": "POST", "mode": "block", "severity": 9.8, "slug": "vayu-blocks", "tags": ["missing-authorization", "arbitrary-plugin-install", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2024-10222-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~]|\\\\bon(?:load|error|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|xlink:href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript~i"}], "cve": "CVE-2024-10222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10222", "description": "SVG Support <=2.5.10 stored XSS via unsanitized SVG file upload through REST API media endpoint", "mode": "block", "severity": 6.4, "slug": "svg-support", "tags": ["xss", "stored-xss", "file-upload", "svg", "rest-api"], "target": "plugin", "versions": "<=2.5.10"}, "RULE-CVE-2024-10247-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "video-gallery"}, {"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2024-10247", "method": "GET", "mode": "block", "severity": 4.9, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2024-10247-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "video-gallery"}, {"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2024-10247", "method": "GET", "mode": "block", "severity": 4.9, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2024-10310-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~image_title[^}]*(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:svg|img|iframe|details|object|embed|math|audio|video|body|marquee|isindex|form|input|button|textarea|select|base|link|meta|style|applet|xml)[\\\\s/>][^}]*?\\\\bon(?:error|load|toggle|click|mouseover|focus|blur|pointerover|animationend|transitionend)\\\\s*=|<[^>]{0,50}javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10310", "description": "Element Pack Elementor Addons <=5.10.1 Contributor+ Stored XSS via Custom Gallery Widget image_title parameter", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "target": "plugin", "versions": "<=5.10.1"}, "RULE-CVE-2024-10310-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~image_accordion_title[^}]*(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:svg|img|iframe|details|object|embed|math|audio|video|body|marquee|isindex|form|input|button|textarea|select|base|link|meta|style|applet|xml)[\\\\s/>][^}]*?\\\\bon(?:error|load|toggle|click|mouseover|focus|blur|pointerover|animationend|transitionend)\\\\s*=|<[^>]{0,50}javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10310", "description": "Element Pack Elementor Addons <=5.10.1 Contributor+ Stored XSS via Image Accordion Widget image_accordion_title parameter", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "target": "plugin", "versions": "<=5.10.1"}, "RULE-CVE-2024-10322-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/(?:async-upload|media-new)\\\\.php|^/wp-json/wp/v2/media|(?:^|&|\\\\?)rest_route=/wp/v2/media)~i"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|animationiteration|animationend|begin|end|repeat)\\\\s*=|javascript\\\\s*:|]|xlink:href\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|data):)~i"}], "cve": "CVE-2024-10322", "description": "Brizy <=2.6.8 author+ stored XSS via malicious SVG file upload (insufficient sanitization in wp_handle_upload_prefilter) - classic media upload endpoints", "mode": "block", "severity": 5.4, "slug": "brizy", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-10322-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|animationiteration|animationend|begin|end|repeat)\\\\s*=|javascript\\\\s*:|]|xlink:href\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|data):)~i"}], "cve": "CVE-2024-10322", "description": "Brizy <=2.6.8 author+ stored XSS via malicious SVG upload through REST media endpoint (file field)", "mode": "block", "severity": 5.4, "slug": "brizy", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-10367-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:content", "type": "regex", "value": "~<\\\\s*script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:embed|object|iframe)[\\\\s/>]~i"}], "cve": "CVE-2024-10367", "description": "Otter Blocks <=3.0.4 stored XSS via malicious SVG file upload through REST API media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2024-1037-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^aiowpsec~i"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<|%3[Cc]|%25(?:3[Cc]|2[5%]3[Cc]))(?:script|svg|img|iframe|s[\\\\s/]*v[\\\\s/]*g|/?[a-z]+[\\\\s/]+on[a-z]+\\\\s*=)|on(?:load|error|click|mouseover|focus|submit)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*(?:script|html)~i"}], "cve": "CVE-2024-1037", "description": "All-In-One Security (AIOS) <=5.2.5 reflected XSS via tab parameter on AIOS admin pages (wp-security-list-404.php)", "mode": "block", "severity": 6.1, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.2.5"}, "RULE-CVE-2024-10392-01": {"ajax_action": "wpaicg_save_image_media", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-10392", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gpt3-ai-content-generator", "target": "plugin", "versions": "<=1.8.89"}, "RULE-CVE-2024-10400-01": {"ajax_action": "load_filtered_instructor", "conditions": [{"name": "ARGS:rating_filter", "type": "regex", "value": "~[^1-5]~"}], "cve": "CVE-2024-10400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10400", "description": "Tutor LMS <=2.7.6 unauthenticated SQLi via rating_filter POST param in the load_filtered_instructor AJAX action (Utils::get_instructors HAVING clause, Utils.php:3193)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2024-10402-01": {"ajax_action": "forminator_save_builder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10402", "description": "Forminator <=1.35.1 missing authorization on forminator_save_builder allows contributor+ form creation/editing", "mode": "block", "severity": 8.8, "slug": "forminator", "target": "plugin", "versions": "<=1.35.1"}, "RULE-CVE-2024-10453-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~global_typography_title.*?(?:]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|body|input|details|marquee)[\\\\s>])~i"}], "cve": "CVE-2024-1070", "description": "SiteOrigin Widgets Bundle <=1.58.2 contributor+ stored XSS via Features widget instance fields on so_widgets_setting_save", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.2"}, "RULE-CVE-2024-1070-02": {"ajax_action": "so_widgets_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|body|input|details|marquee)[\\\\s>])~i"}], "cve": "CVE-2024-1070", "description": "SiteOrigin Widgets Bundle <=1.58.2 contributor+ stored XSS via Features widget rendered through so_widgets_preview AJAX", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.2"}, "RULE-CVE-2024-1071-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:sorting", "type": "detectSQLi"}], "cve": "CVE-2024-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1071", "description": "Ultimate Member >=2.1.3 <=2.8.2 unauthenticated SQL injection via sorting parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": ">=2.1.3 <=2.8.2"}, "RULE-CVE-2024-10711-02": {"action": "admin_post_itwr_activation_plugin", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "itwr_activation_plugin"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2024-10711", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ithemelandco-woo-report", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2024-10715-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:mappress/map[\\\\s\\\\S]{0,4000}?(?:]|on(?:load|error|click|mouseover|focus|mouseenter|mouseout|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-10715", "description": "MapPress Maps for WordPress <=2.94.1 contributor+ stored XSS via mappress/map Gutenberg block attributes (REST posts endpoint)", "mode": "block", "severity": 5.4, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.94.1"}, "RULE-CVE-2024-10715-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:mappress/map[\\\\s\\\\S]{0,4000}?(?:]|on(?:load|error|click|mouseover|focus|mouseenter|mouseout|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-10715", "description": "MapPress Maps for WordPress <=2.94.1 contributor+ stored XSS via mappress/map Gutenberg block attributes (classic post.php editor submit)", "mode": "block", "severity": 5.4, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.94.1"}, "RULE-CVE-2024-1072-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seedprod_lite_template"}, {"name": "ARGS:id", "type": "equals", "value": "0"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-1072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1072", "description": "SeedProd (Coming Soon) <=6.15.21 missing authorization on seedprod_lite_new_lpage via admin_init", "mode": "block", "severity": 8.2, "slug": "coming-soon", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.15.21"}, "RULE-CVE-2024-10728-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "install_required_plugin"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-10728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10728", "description": "PostX \\u2013 Post Grid Gutenberg Blocks <=4.1.16 missing authorization on install_required_plugin AJAX action allows Subscriber+ arbitrary plugin installation/activation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-post", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2024-10871-01A": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10871-01B": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~(?i)^(?:php|data|zip|phar)://~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10871-01C": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~^(?:/|[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10873-01": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-10873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-10873-02": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2024-10873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-10899-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~\\\\[/?[a-zA-Z]~"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated arbitrary shortcode execution via id parameter in wcpt_ajax handler", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["code-injection", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-01B": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "wcpt_ajax"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\[/?[a-zA-Z]~"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated arbitrary shortcode execution via id parameter in wc-ajax wcpt_ajax endpoint", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["code-injection", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-02": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[<\\"\']|\\\\b(?:on(?:error|load|click|mouseover|focus)|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated reflected XSS via id parameter in wcpt_ajax handler", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-02B": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "wcpt_ajax"}, {"name": "ARGS:id", "type": "regex", "value": "~[<\\"\']|\\\\b(?:on(?:error|load|click|mouseover|focus)|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated reflected XSS via id parameter in wc-ajax wcpt_ajax endpoint", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10913-01": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 unauthenticated PHP Object Injection - capability gate on search-n-replace AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "missing-authorization", "deserialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-02": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 PHP Object Injection via serialized payload in search parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "deserialization", "php-serialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-03": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"name": "ARGS:replace", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 PHP Object Injection via serialized payload in replace parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "deserialization", "php-serialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-04": {"ajax_action": "wpclone-install_new", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 unauthenticated PHP Object Injection - capability gate on install_new AJAX action (indirect vector via backup restore)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "missing-authorization", "deserialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/reallysimplessl/v1/two_fa/skip_onboarding(?:/|\\\\?|$)~"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-10924", "description": "Really Simple Security >=9.0.0 <=9.1.1.1 unauthenticated authentication bypass via two-factor REST API skip_onboarding endpoint", "mode": "block", "severity": 9.8, "slug": "really-simple-ssl", "target": "plugin", "versions": ">=9.0.0 <=9.1.1.1"}, "RULE-CVE-2024-10932-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~O:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{|s:[0-9]+:\\"O:[0-9]+:\\\\\\\\\\"[^\\"]+\\\\\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-10932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10932", "description": "Backup Migration <=1.4.6 PHP object injection payload planting via comment content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "backup-backup", "tags": ["object-injection", "deserialization", "comments", "unauthenticated"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2024-10932-02": {"ajax_action": "backup_migration", "conditions": [{"name": "ARGS:f", "type": "equals", "value": "startLocalStagingCreation"}, {"name": "ARGS", "type": "regex", "value": "~O:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{|s:[0-9]+:\\"O:[0-9]+:\\\\\\\\\\"[^\\"]+\\\\\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-10932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10932", "description": "Backup Migration <=1.4.6 PHP object injection via backup_migration staging request payloads", "method": "POST", "mode": "block", "severity": 8.8, "slug": "backup-backup", "tags": ["object-injection", "deserialization", "ajax", "staging"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2024-10936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:O|C):\\\\d+:\\\\\\"~"}], "cve": "CVE-2024-10936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10936", "description": "String Locator <=2.6.6 unauthenticated PHP Object Injection via comment content planting", "method": "POST", "mode": "block", "severity": 8.8, "slug": "string-locator", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=2.6.6"}, "RULE-CVE-2024-10942-01": {"ajax_action": "ai1wm_import", "conditions": [{"name": "FILES:import:content", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2024-10942", "description": "All in One WP Migration <=7.89 unauthenticated PHP object injection via backup file import", "mode": "block", "severity": 7.5, "slug": "all-in-one-wp-migration", "target": "plugin", "versions": "<=7.89"}, "RULE-CVE-2024-10960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^brizy[-_]upload[-_]blocks$~i"}, {"name": "FILES:files", "type": "exists"}], "cve": "CVE-2024-10960", "method": "POST", "mode": "block", "severity": 8.8, "slug": "brizy", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-10960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^brizy[-_]upload[-_]layouts$~i"}, {"name": "FILES:files", "type": "exists"}], "cve": "CVE-2024-10960", "method": "POST", "mode": "block", "severity": 8.8, "slug": "brizy", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-11052-02": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:calculations", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|body|input|object|embed)\\\\b)~i"}], "cve": "CVE-2024-11052", "description": "Ninja Forms <=3.8.19 stored XSS via calculations parameter on nf_ajax_submit unauthenticated handler", "mode": "block", "severity": 6.1, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.8.19"}, "RULE-CVE-2024-11103-01": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "ARGS:pass1", "type": "exists"}], "cve": "CVE-2024-11103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11103", "description": "Contest Gallery <=24.0.7 unauthenticated arbitrary password reset via post_cg_login AJAX handler (user_id + pass1)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<=24.0.7"}, "RULE-CVE-2024-11103-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordSiteUrl", "type": "exists"}], "cve": "CVE-2024-11103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11103", "description": "Contest Gallery <=24.0.7 unauthenticated URL injection in password reset email via cgLostPasswordSiteUrl", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "tags": ["phishing", "url-injection", "unauthenticated", "weak-password-recovery"], "target": "plugin", "versions": "<=24.0.7"}, "RULE-CVE-2024-11180-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~ekit_countdown_timer_title[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=|]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11180", "description": "ElementsKit Elementor Addons <=3.4.7 Stored XSS via Countdown Timer ekit_countdown_timer_title (Elementor AJAX save)", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2024-11180-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~ekit_countdown_timer_title[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=|]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11180", "description": "ElementsKit Elementor Addons <=3.4.7 Stored XSS via Countdown Timer ekit_countdown_timer_title (Elementor REST save)", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2024-11188-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "frm_forms_preview"}, {"name": "ARGS:frm_action", "type": "equals", "value": "preview"}, {"name": "ARGS", "type": "regex", "value": "~]~i"}], "cve": "CVE-2024-11188", "description": "Formidable Forms <=6.16.1.2 stored XSS via form item parameters in preview", "method": "POST", "mode": "block", "severity": 6.5, "slug": "formidable", "tags": ["xss", "stored-xss", "form-builder"], "target": "plugin", "versions": "<=6.16.1.2"}, "RULE-CVE-2024-11270-01": {"ajax_action": "sync-import-imgs", "conditions": [{"type": "missing_capability", "value": "_wswebinar_createwebinars"}], "cve": "CVE-2024-11270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11270", "description": "WebinarPress <=1.33.24 missing authorization on sync-import-imgs AJAX allowing subscriber+ arbitrary file creation (RCE)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-webinarsystem", "tags": ["missing-authorization", "arbitrary-file-upload", "remote-code-execution"], "target": "plugin", "versions": "<=1.33.24"}, "RULE-CVE-2024-11270-02": {"ajax_action": "sync-import-imgs", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2024-11270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11270", "description": "WebinarPress <=1.33.24 arbitrary file upload via sync-import-imgs with executable file extension", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-webinarsystem", "tags": ["arbitrary-file-upload", "remote-code-execution", "file-extension-bypass"], "target": "plugin", "versions": "<=1.33.24"}, "RULE-CVE-2024-11323-01": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:colors", "type": "exists"}, {"name": "ARGS:colors", "type": "regex", "value": "~[\\"\'](?:default_role|users_can_register|siteurl|home|admin_email|blogname|blogdescription|template|stylesheet|active_plugins|permalink_structure|mailserver_url|hack_file|db_version)[\\"\']\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated arbitrary options update via ai_quiz_update_style AJAX handler - dangerous option names in colors JSON", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11323-02": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:colors", "type": "regex", "value": "~<\\\\s*/\\\\s*style|<\\\\s*script|on(?:error|load|click|mouseover)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated stored XSS via ai_quiz_update_style colors parameter - style tag breakout", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "stored-xss"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11323-03": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:phrase", "type": "regex", "value": "~<\\\\s*/\\\\s*style|<\\\\s*script|on(?:error|load|click|mouseover)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated stored XSS via ai_quiz_update_style phrase parameter - style tag breakout", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "stored-xss"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11415-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-orphanage-extended"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wporphanageex_role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2024-11415", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11415", "description": "WP-Orphanage Extended <=1.2 CSRF to orphan account privilege escalation via settings page role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-orphanage-extended", "tags": ["csrf", "privilege-escalation", "settings-update"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2024-11429-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stars[_-]testimonials(?:-with-slider-and-masonry-grid)?|testimonial[_-]stars)[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|phar://|data://)~i"}], "cve": "CVE-2024-11429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11429", "description": "Stars Testimonials <=3.3.3 Local File Inclusion via shortcode attribute in post_content (post.php)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "stars-testimonials-with-slider-and-masonry-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-11429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:stars[_-]testimonials(?:-with-slider-and-masonry-grid)?|testimonial[_-]stars)[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|phar://|data://)~i"}], "cve": "CVE-2024-11429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11429", "description": "Stars Testimonials <=3.3.3 Local File Inclusion via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "stars-testimonials-with-slider-and-masonry-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-11582-01": {"ajax_action": "subscribe2_submit", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|input|video|audio|source|link|style|meta|form|button|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|focusin|focusout|blur|change|submit|input|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|wheel|keydown|keyup|keypress|drag|drop|dragstart|dragend|dragover|copy|paste|cut)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z/+0-9-]*(?:base64|;)|expression\\\\s*\\\\(|%3[Cc](?:script|svg|img|iframe|body)|�*60;?(?:script|svg|img|iframe))~i"}], "cve": "CVE-2024-11582", "description": "Subscribe2 <=10.43 unauthenticated stored XSS via ip parameter on subscribe2_submit AJAX action", "mode": "block", "severity": 7.2, "slug": "subscribe2", "target": "plugin", "versions": "<=10.43"}, "RULE-CVE-2024-11582-02": {"ajax_action": "subscribe2_form", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|input|video|audio|source|link|style|meta|form|button|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|focusin|focusout|blur|change|submit|input|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|wheel|keydown|keyup|keypress|drag|drop|dragstart|dragend|dragover|copy|paste|cut)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z/+0-9-]*(?:base64|;)|expression\\\\s*\\\\(|%3[Cc](?:script|svg|img|iframe|body)|�*60;?(?:script|svg|img|iframe))~i"}], "cve": "CVE-2024-11582", "description": "Subscribe2 <=10.43 unauthenticated stored XSS via ip parameter on subscribe2_form AJAX action", "mode": "block", "severity": 7.2, "slug": "subscribe2", "target": "plugin", "versions": "<=10.43"}, "RULE-CVE-2024-11642-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[grid_style]", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]{1,}){2,}~"}], "cve": "CVE-2024-11642", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ajax-filter-posts", "target": "plugin", "versions": "<=3.4.11"}, "RULE-CVE-2024-11642-02": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[filter_style]", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]{1,}){2,}~"}], "cve": "CVE-2024-11642", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ajax-filter-posts", "target": "plugin", "versions": "<=3.4.11"}, "RULE-CVE-2024-11643-01": {"ajax_action": "AllAccessible_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11643", "method": "POST", "mode": "block", "severity": 8.8, "slug": "allaccessible", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2024-1166-01": {"ajax_action": "eihe_top_notice", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2024-1166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1166", "description": "Image Hover Effects Addon for Elementor <=1.4.1 missing authorization on eihe_top_notice AJAX handler", "mode": "block", "severity": 6.4, "slug": "image-hover-effects-addon-for-elementor", "tags": ["missing-authorization", "csrf"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-11689-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - users_can_register escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - default_role escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:siteurl", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - siteurl hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:home", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - home URL hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:admin_email", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - admin_email hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "account-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:blogdescription", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - blogdescription defacement", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-defacement"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:permalink_structure", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - permalink_structure manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-defacement"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:template", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - template/theme hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:stylesheet", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - stylesheet/theme hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:active_plugins", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - active_plugins manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-1171-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eael-filterable-gallery[\\\\s\\\\S]*?(?:]|javascript\\\\s*:|&#(?:0*(?:10[69]|74|[xX]0*(?:6[Aa9]|4[1a]))|x0*(?:6[Aa]|4[1Aa]));)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11731", "description": "Master Slider <=3.10.7 stored XSS via ms_slider shortcode class/css_class attributes", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.7"}, "RULE-CVE-2024-11816-01": {"ajax_action": "handle_snippet_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:snippet_id", "type": "exists"}, {"name": "ARGS:snippet_code", "type": "exists"}], "cve": "CVE-2024-11816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11816", "description": "WP Extended <=3.0.11 authenticated RCE via missing authorization on handle_snippet_update AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpextended", "tags": ["missing-authorization", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.0.11"}, "RULE-CVE-2024-11848-01": {"ajax_action": "nitropack_dismiss_notice_forever", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11848", "mode": "block", "severity": 8.1, "slug": "nitropack", "target": "plugin", "versions": "<=1.17.0"}, "RULE-CVE-2024-11868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/material/\\\\d+(?:[/?&]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11868", "method": "GET", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.3"}, "RULE-CVE-2024-11921-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:donor", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:donor", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-reports~"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-12": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-tools~"}, {"name": "ARGS:per_page", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-13": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-14": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11974-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:smc_settings_tab", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via smc_settings_tab parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-11974-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:unattachfixit-action", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via unattachfixit-action parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-11974-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:woofixit-action", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via woofixit-action parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-1203-01": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:valueData", "type": "regex", "value": "~(?:\'\\\\s*(?:OR|AND)\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+=\\\\d+|UNION\\\\s+SELECT|SELECT\\\\s+.+\\\\s+FROM|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|--\\\\s*$|/\\\\*|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via valueData in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-02": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:conditionData", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via conditionData in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-03": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:productArray", "type": "detectSQLi"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+SELECT|SELECT\\\\s+.+\\\\s+FROM|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|OR\\\\s+\\\\d+=\\\\d+|AND\\\\s+\\\\d+=\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|--\\\\s*$|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via productArray in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-04": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:exclude", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via exclude in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-05": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:include", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via include in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-12040-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\.\\\\\\\\)[^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) Local File Inclusion via [wcpcsu] shortcode theme attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?(?:php|data|expect|zip|phar)://~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) Local File Inclusion via [wcpcsu] shortcode theme attribute with PHP wrapper in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\.\\\\\\\\)[^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) LFI via REST API post content with [wcpcsu] shortcode theme traversal", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?(?:php|data|expect|zip|phar)://~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) LFI via REST API post content with [wcpcsu] shortcode theme PHP wrapper", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-1206-01": {"ajax_action": "wprm_import_recipes", "conditions": [{"name": "ARGS:recipes", "type": "regex", "value": "~[^0-9,\\\\s]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1206", "description": "WP Recipe Maker <=9.1.2 authenticated SQL injection via recipes parameter (scalar) in wprm_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-recipe-maker", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2024-1206-02": {"ajax_action": "wprm_import_recipes", "conditions": [{"name": "ARGS:recipes[0]", "type": "regex", "value": "~[^0-9,\\\\s]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1206", "description": "WP Recipe Maker <=9.1.2 authenticated SQL injection via recipes[] array element in wprm_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-recipe-maker", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2024-1207-01": {"ajax_action": "WPBC_AJX_CALENDAR_LOAD", "conditions": [{"name": "ARGS:calendar_request_params[dates_ddmmyy_csv]", "type": "regex", "value": "~[^0-9.,\\\\-\\\\s;]~"}], "cve": "CVE-2024-1207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1207", "description": "WP Booking Calendar <=9.9 unauthenticated SQL injection via calendar_request_params[dates_ddmmyy_csv] in WPBC_AJX_CALENDAR_LOAD", "method": "POST", "mode": "block", "severity": 9.8, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=9.9"}, "RULE-CVE-2024-1207-02": {"ajax_action": "WPBC_AJX_BOOKING__CREATE", "conditions": [{"name": "ARGS:calendar_request_params[dates_ddmmyy_csv]", "type": "regex", "value": "~[^0-9.,\\\\-\\\\s;]~"}], "cve": "CVE-2024-1207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1207", "description": "WP Booking Calendar <=9.9 unauthenticated SQL injection via calendar_request_params[dates_ddmmyy_csv] in WPBC_AJX_BOOKING__CREATE", "method": "POST", "mode": "block", "severity": 9.8, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=9.9"}, "RULE-CVE-2024-12171-01": {"ajax_action": "eh_crm_agent_add_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12171", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2024-12238-01": {"ajax_action": "nf_preview_update", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-12238", "description": "Ninja Forms <=3.8.22 authenticated (subscriber+) arbitrary shortcode execution via nf_preview_update AJAX action (do_shortcode on attacker-controlled preview content in includes/Display/Preview.php)", "mode": "block", "severity": 6.3, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.8.22"}, "RULE-CVE-2024-12259-01": {"ajax_action": "wc_update_user_data", "conditions": [{"name": "ARGS:update_user", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12259", "method": "POST", "mode": "block", "severity": 8.8, "slug": "computer-repair-shop", "target": "plugin", "versions": "<=3.8120"}, "RULE-CVE-2024-12264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/get-shipping-cost(?:[/?&]|$)~"}, {"name": "ARGS:username", "type": "exists"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/get-shipping-cost(?:[/?&]|$)~"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12264-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/generate-user-token(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12304-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/singlebtn[^}]*\\"link\\"\\\\s*:\\\\s*\\"(?:javascript\\\\s*:|[^\\"]*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12304", "description": "Kadence Blocks <=3.4.2 contributor+ stored XSS via singlebtn block link attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-12304-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/singlebtn[^}]*\\"link\\"\\\\s*:\\\\s*\\"(?:javascript\\\\s*:|[^\\"]*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12304", "description": "Kadence Blocks <=3.4.2 contributor+ stored XSS via singlebtn block link attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-12322-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "theperfectweddingnl-widget/tpw.php"}, {"name": "ARGS:tpwKey", "type": "regex", "value": "~(?:]*on|<\\\\s*img\\\\b[^>]*on|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1278", "description": "Easy Facebook Likebox <=6.5.4 contributor+ stored XSS via efb_likebox shortcode attributes in post content (classic editor save)", "mode": "block", "severity": 5.4, "slug": "easy-facebook-likebox", "target": "plugin", "versions": "<=6.5.4"}, "RULE-CVE-2024-1278-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[efb_likebox\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousedown|mouseup|keydown|keyup|keypress|submit|change|input)\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b[^>]*on|<\\\\s*img\\\\b[^>]*on|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1278", "description": "Easy Facebook Likebox <=6.5.4 contributor+ stored XSS via efb_likebox shortcode attributes in REST post create/update", "mode": "block", "severity": 5.4, "slug": "easy-facebook-likebox", "target": "plugin", "versions": "<=6.5.4"}, "RULE-CVE-2024-12875-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "download"}, {"name": "ARGS:/^edd_download_files$/", "type": "regex", "value": "~(?i)(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|\\\\.\\\\.\\\\.\\\\.//)~i"}], "cve": "CVE-2024-12875", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-12877-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:firstName", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:lastName", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:gateway", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12881-01": {"ajax_action": "eos_plugin_reviews_restore_version", "conditions": [{"name": "ARGS:dir", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12881", "method": "POST", "mode": "block", "severity": 8.8, "slug": "plugversions", "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2024-1289-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:profile|user-profile)/[^/]+/orders/.*~"}, {"name": "ARGS:view-order", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1289", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.3"}, "RULE-CVE-2024-12919-01": {"action": "init", "conditions": [{"name": "ARGS:pms_payment_id", "type": "regex", "value": "~^0*[1-9][0-9]*$~"}, {"name": "ARGS:pms_autologin_before_redirect", "type": "equals", "value": "true"}], "cve": "CVE-2024-12919", "mode": "block", "severity": 9.8, "slug": "paid-member-subscriptions", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-13127-01": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/settings~i"}], "cve": "CVE-2024-13127", "description": "Broken access control allows non-admin users to modify LearnPress display settings via REST API", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.5"}, "RULE-CVE-2024-13128-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~i"}, {"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:primary_color", "type": "detectXSS"}, {"name": "ARGS:secondary_color", "type": "detectXSS"}, {"name": "ARGS:width_container", "type": "detectXSS"}, {"name": "ARGS:learn_press[primary_color]", "type": "detectXSS"}, {"name": "ARGS:learn_press[secondary_color]", "type": "detectXSS"}, {"name": "ARGS:learn_press[width_container]", "type": "detectXSS"}], "cve": "CVE-2024-13128", "description": "Broken access control allows non-admin users to modify LearnPress color settings via REST API", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.5"}, "RULE-CVE-2024-1315-01": {"ajax_action": "rtcl_update_user_account", "conditions": [{"name": "ARGS:email", "type": "exists"}, {"name": "ARGS:pass1", "type": "exists"}], "cve": "CVE-2024-1315", "method": "POST", "mode": "block", "severity": 8.8, "slug": "classified-listing", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2024-1317-01": {"ajax_action": "feedzy", "conditions": [{"name": "ARGS:search_key", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1317", "method": "POST", "mode": "block", "severity": 8.8, "slug": "feedzy-rss-feeds", "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2024-13183-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"title_tag\\"\\\\s*:\\\\s*\\"(?!(?:h[1-6]|p)\\")[^\\"]*(?:[<>\\"=/\\\\s]|on[a-z]+\\\\s*=|javascript\\\\s*:|script|svg|iframe|img|onerror|onload|onmouseover)~i"}], "cve": "CVE-2024-13183", "description": "Orbit Fox by ThemeIsle (themeisle-companion) <=2.10.43 contributor+ stored XSS via Pricing Table widget title_tag parameter", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2024-13183-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"subtitle_tag\\"\\\\s*:\\\\s*\\"(?!(?:h[1-6]|p)\\")[^\\"]*(?:[<>\\"=/\\\\s]|on[a-z]+\\\\s*=|javascript\\\\s*:|script|svg|iframe|img|onerror|onload|onmouseover)~i"}], "cve": "CVE-2024-13183", "description": "Orbit Fox by ThemeIsle (themeisle-companion) <=2.10.43 contributor+ stored XSS via Pricing Table widget subtitle_tag parameter", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2024-13227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/rank-math(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-13227", "mode": "block", "severity": 5.4, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.235"}, "RULE-CVE-2024-13227-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/rank-math(/|\\\\?|$)~"}, {"name": "ARGS:is_new", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-13227", "mode": "block", "severity": 5.4, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.235"}, "RULE-CVE-2024-13315-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "shopwarden"}, {"name": "ARGS:action", "type": "equals", "value": "save_setting"}, {"name": "ARGS:key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-13315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13315", "description": "Shopwarden <=1.0.11 CSRF to arbitrary WordPress options update via admin.php page=shopwarden action=save_setting", "mode": "block", "severity": 8.8, "slug": "shopwarden", "tags": ["csrf", "broken-access-control", "options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.11"}, "RULE-CVE-2024-13353-01": {"ajax_action": "rael_products_pagination_product", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_products_pagination_product AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13353-02": {"ajax_action": "rael_woo_product_pagination", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_woo_product_pagination AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13353-03": {"ajax_action": "rael_load_more", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~freemius-pricing\\\\.js~"}, {"name": "ARGS:url", "type": "regex", "value": "~(]|<[^>]+on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-13757", "description": "Master Slider <=3.10.6 stored XSS via ms_layer shortcode effect attribute in post content", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.6"}, "RULE-CVE-2024-13789-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/__ravpage/api([#?]|$)~"}, {"name": "ARGS:paramsv2", "type": "regex", "value": "~(?:Tzo|Qzo)~"}], "cve": "CVE-2024-13789", "mode": "block", "severity": 9.8, "slug": "ravpage", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2024-13803-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/[a-z-]+[^}]*[\\"\']dataMarker[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|\\\\s*]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|\\\\s*]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1409", "description": "ProfilePress <=4.15.0 contributor+ stored XSS via [reg-select-role] shortcode default_role attribute", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.0"}, "RULE-CVE-2024-1424-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1463-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "accept-request"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-1463", "method": "GET", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.6.4"}, "RULE-CVE-2024-1463-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "deny-request"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-1463", "method": "GET", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.6.4"}, "RULE-CVE-2024-1497-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~addr2_width[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1497", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via addr2_width widget attribute in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~addr2_width[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1497", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via addr2_width widget attribute in Elementor REST API save", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1499-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~title_tags[^}]*(?:on(?:mouse(?:over|enter|move|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run|start)|change|input|submit|resize|scroll|contextmenu|pointerdown|pointermove|pointerup|pointerenter|pointerleave|touchstart|touchmove|touchend|wheel|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste)\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|form|base|link|meta|style)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1499", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via Pricing Table widget title_tags parameter", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1499-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document(/|\\\\?|$)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~title_tags[^}]*(?:on(?:mouse(?:over|enter|move|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run|start)|change|input|submit|resize|scroll|contextmenu|pointerdown|pointermove|pointerup|pointerenter|pointerleave|touchstart|touchmove|touchend|wheel|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste)\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|form|base|link|meta|style)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1499", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via Pricing Table widget title_tags parameter (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1510-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_tooltip\\\\b[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1510", "description": "Shortcodes Ultimate <=7.0.2 contributor+ stored XSS via su_tooltip shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.2"}, "RULE-CVE-2024-1510-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_tooltip\\\\b[^\\\\]]*tag\\\\s*=\\\\s*[\\"\']?(?:script|img|iframe|svg|object|embed|details|body|marquee|video|audio|math)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1510", "description": "Shortcodes Ultimate <=7.0.2 contributor+ stored XSS via su_tooltip tag attribute injection in post content", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.2"}, "RULE-CVE-2024-1512-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user", "type": "detectSQLi"}], "cve": "CVE-2024-1512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1512", "description": "MasterStudy LMS <=3.2.5 unauthenticated SQL injection via user parameter in /stm-lms/order/items REST endpoint", "method": "GET", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2024-1535-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[profilepress-(?:registration|edit-profile|login|user-profile|melange|member-directory|my-account)\\\\b[^\\\\]]*(?:on(?:focus|blur|click|error|load|mouseover|animationstart|animationend|transitionend|pointerover)\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1535", "description": "ProfilePress <=4.15.2 contributor+ stored XSS via shortcode attribute injection in REST API post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.2"}, "RULE-CVE-2024-1536-01A": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\\\"widgetType\\\\\\"\\\\s*:\\\\s*\\\\\\"eael-event-calendar\\\\\\"~"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\\\\\"eael_event_(?:calendar_first_day|details_link_hide)\\\\\\"\\\\s*:\\\\s*\\\\\\"\\\\\\\\\\\\\\"\\\\s+on[a-z]+\\\\s*=~"}], "cve": "CVE-2024-1536", "method": "POST", "mode": "block", "severity": 7.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1536-01B": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\\\\\"widgetType\\\\\\"\\\\s*:\\\\s*\\\\\\"eael-event-calendar\\\\\\"~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\\\\\"eael_event_(?:calendar_first_day|details_link_hide)\\\\\\"\\\\s*:\\\\s*\\\\\\"\\\\\\\\\\\\\\"\\\\s+on[a-z]+\\\\s*=~"}], "cve": "CVE-2024-1536", "method": "POST", "mode": "block", "severity": 7.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1537-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2024-1537", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1570-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*login-password\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*(?:(?:"|%22|\\")\\\\s*(?:on[a-z]+|style|formaction)\\\\s*=|javascript\\\\s*:|]|on(?:load|error|click|mouseover|focus|blur|input|submit|change|toggle|animationend)\\\\s*=|javascript\\\\s*:|srcdoc\\\\s*=|formaction\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1582", "description": "WP Go Maps (formerly WP Google Maps) <=9.0.32 contributor+ stored XSS via wpgmza shortcode attributes in post content", "mode": "block", "severity": 5.4, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.32"}, "RULE-CVE-2024-1685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_button"}, {"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in save_button handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-02": {"ajax_action": "import_buttons", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in import_buttons AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "export_button"}, {"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in export_button handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-04": {"ajax_action": "clone_button", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in clone_button AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1698-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics(?:/|\\\\?|&|$)~"}, {"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2024-1698", "mode": "block", "severity": 9.8, "slug": "notificationx", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-1710-01": {"ajax_action": "unitecreator_ajax_action", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^unitecreator_ajax_action$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1710", "description": "Addon Library <=1.3.76 missing authorization on AJAX handler allows subscriber+ arbitrary actions including file upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "addon-library", "tags": ["missing-authorization", "arbitrary-file-upload", "broken-access-control"], "target": "plugin", "versions": "<=1.3.76"}, "RULE-CVE-2024-1723-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:widget-sow-headline[instance][headline_tag]", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]|[\\"\']>)~i"}], "cve": "CVE-2024-1723", "description": "SiteOrigin Widgets Bundle <=1.58.7 authenticated reflected XSS via postId in so_widgets_links_get_title", "mode": "block", "severity": 6.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.7"}, "RULE-CVE-2024-1751-01": {"ajax_action": "tutor_qna_single_action", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tutor_qna_single_action"}, {"name": "ARGS:question_id", "type": "detectSQLi"}], "cve": "CVE-2024-1751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1751", "description": "Tutor LMS <=2.6.1 authenticated SQL injection via question_id in tutor_qna_single_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-1751-02": {"ajax_action": "tutor_q_and_a_load_more", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tutor_q_and_a_load_more"}, {"name": "ARGS:question_id", "type": "detectSQLi"}], "cve": "CVE-2024-1751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1751", "description": "Tutor LMS <=2.6.1 authenticated SQL injection via question_id in tutor_q_and_a_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-1755-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nps-plugin-options"}, {"name": "ARGS:event", "type": "equals", "value": "delete_all"}], "cve": "CVE-2024-1755", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nps-computy", "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2024-1755-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nps-plugin-options"}, {"name": "ARGS:event", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "regex", "value": "~^[0-9]+$~i"}], "cve": "CVE-2024-1755", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nps-computy", "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2024-1770-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_tags[0]", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1770", "method": "POST", "mode": "block", "severity": 8.8, "slug": "meta-tag-manager", "target": "plugin", "versions": "<3.1"}, "RULE-CVE-2024-1775-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|\\\\beval\\\\b|\\\\balert\\\\()~i"}], "cve": "CVE-2024-1775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1775", "description": "Nextend Facebook Connect <=3.1.12 reflected XSS via error_description OAuth parameter", "method": "GET", "mode": "block", "severity": 5.4, "slug": "nextend-facebook-connect", "tags": ["xss", "reflected", "oauth", "authenticated"], "target": "plugin", "versions": "<=3.1.12"}, "RULE-CVE-2024-1797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_ulike(?:_counter)?\\\\s[^\\\\]]*(?:id|status)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\'|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP\\\\s*\\\\(|BENCHMARK|EXTRACTVALUE|CONCAT\\\\s*\\\\(|information_schema|/\\\\*)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1797", "description": "WP ULike <=4.6.9 authenticated (Contributor+) SQL injection via wp_ulike/wp_ulike_counter shortcode attributes in post content submitted to post.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-ulike", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.9"}, "RULE-CVE-2024-1797-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_ulike(?:_counter)?\\\\s[^\\\\]]*(?:id|status)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\'|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP\\\\s*\\\\(|BENCHMARK|EXTRACTVALUE|CONCAT\\\\s*\\\\(|information_schema|/\\\\*)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1797", "description": "WP ULike <=4.6.9 authenticated (Contributor+) SQL injection via wp_ulike/wp_ulike_counter shortcode attributes in post content submitted to REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-ulike", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.6.9"}, "RULE-CVE-2024-1806-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:profilepress-edit-profile|profilepress-login|profilepress-password-reset|profilepress-melange-password-reset|ppress_content_condition)\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1806", "description": "ProfilePress <=4.15.1 stored XSS via shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.1"}, "RULE-CVE-2024-1808-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 contributor+ stored XSS via su_qrcode shortcode attributes (placeholder, alt, title, content) on post save", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1808-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 contributor+ stored XSS via su_qrcode shortcode in REST API post content", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1808-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 reflected XSS via su_qrcode in su_generator_preview AJAX shortcode parameter", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1815-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr[paginateArrow]", "type": "detectXSS"}], "cve": "CVE-2024-1815", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.8"}, "RULE-CVE-2024-1815-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr[captionDisplayType]", "type": "detectXSS"}], "cve": "CVE-2024-1815", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.8"}, "RULE-CVE-2024-1859-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "slider_responsive"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-1859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1859", "description": "Slider Responsive Slideshow <=1.3.8 authenticated (Contributor+) PHP Object Injection via save_post slider data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "slider-responsive-slideshow", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-1981-01": {"ajax_action": "wpvividstg_start_staging_free", "conditions": [{"name": "ARGS:table_prefix", "type": "exists"}, {"name": "ARGS:table_prefix", "type": "regex", "value": "~[\'\\"`;]|--|#|(?i)\\\\bunion\\\\b|(?i)\\\\bselect\\\\b~"}], "cve": "CVE-2024-1981", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-01": {"ajax_action": "wpvivid_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-02": {"ajax_action": "wpvivid_get_restore_progress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-03": {"ajax_action": "wpvividstg_start_staging_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-04": {"ajax_action": "wpvividstg_get_staging_progress_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1990-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02a": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02b": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02c": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03a": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03b": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03c": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1991-01": {"ajax_action": "rm_update_users_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1991", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.0.0"}, "RULE-CVE-2024-2006-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pgcu_shortcode"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2024-2006", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid-carousel-ultimate", "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2024-2025-01": {"ajax_action": "wc4bp_add_page", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_add_page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2025-02": {"ajax_action": "wc4bp_delete_page", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_delete_page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2025-03": {"ajax_action": "wc4bp_edit_entry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_edit_entry AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2088-01": {"ajax_action": "nxs_getExpSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2088", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2088", "description": "NextScripts Social Networks Auto-Poster <=3.8.8 authenticated sensitive information exposure via nxs_getExpSettings", "mode": "block", "severity": 6.5, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["sensitive-data-exposure", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=3.8.8"}, "RULE-CVE-2024-2115-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "accept-request"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-2115", "method": "GET", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2024-2115-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "deny-request"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-2115", "method": "GET", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2024-2122-01": {"ajax_action": "foogallery_save_gallery_details", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2122", "description": "FooGallery <=2.4.15 contributor+ stored XSS via album gallery custom URLs in save_gallery_details", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=2.4.15"}, "RULE-CVE-2024-2122-02": {"ajax_action": "foogallery_get_gallery_details", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2122", "description": "FooGallery <=2.4.15 contributor+ stored XSS via album gallery custom URLs in get_gallery_details", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=2.4.15"}, "RULE-CVE-2024-2123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/members~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 stored XSS in member directory via display_name", "method": "GET", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "shortcode"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:user_login", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 unauthenticated stored XSS via registration form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2123-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 authenticated stored XSS via profile update", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2125-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envialosimple/v1/gallery/add(?:/|\\\\?|&|$)~"}, {"name": "FILES:file", "type": "exists"}], "cve": "CVE-2024-2125", "method": "POST", "mode": "block", "severity": 8.8, "slug": "envialosimple-email-marketing-y-newsletters-gratis", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2024-21751-01": {"ajax_action": "rabbitloader_ajax_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-02": {"ajax_action": "rabbitloader_mode_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-03": {"ajax_action": "rabbitloader_ajax_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-04": {"ajax_action": "rabbitloader_ajax_survey_dismissed", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-22144-01": {"ajax_action": "GOTMLS_load_update", "conditions": [{"name": "ARGS:GOTMLS_update_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-22144", "description": "Anti-Malware Security and Brute-Force Firewall <=4.21.96 unauthenticated RCE via malicious definition injection through GOTMLS_load_update AJAX handler", "mode": "block", "severity": 9.0, "slug": "gotmls", "target": "plugin", "versions": "<=4.21.96"}, "RULE-CVE-2024-22144-03": {"ajax_action": "GOTMLS_log_session", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-22144", "description": "Anti-Malware Security and Brute-Force Firewall <=4.21.96 unauthenticated server microtime disclosure via GOTMLS_log_session AJAX handler", "mode": "block", "severity": 9.0, "slug": "gotmls", "target": "plugin", "versions": "<=4.21.96"}, "RULE-CVE-2024-22144-04": {"ajax_action": "GOTMLS_lognewkey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-22144", "description": "Anti-Malware Security and Brute-Force Firewall <=4.21.96 unauthenticated nonce brute-force via GOTMLS_mt array submission on GOTMLS_lognewkey AJAX handler", "mode": "block", "severity": 9.0, "slug": "gotmls", "target": "plugin", "versions": "<=4.21.96"}, "RULE-CVE-2024-22152-01": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-22152", "description": "Product Import Export for WooCommerce <=2.3.7 missing authorization on import AJAX handler allows subscriber+ file upload", "mode": "block", "severity": 8.0, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-22152-02": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2024-22152", "description": "Product Import Export for WooCommerce <=2.3.7 unrestricted file upload of dangerous types via import AJAX handler", "mode": "block", "severity": 8.0, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-22288-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wf_woocommerce_packlist"}, {"name": "ARGS:tab", "type": "equals", "value": "debug"}, {"name": "ARGS:wt_status_message", "type": "regex", "value": "~(?:]|=3.14.0"}, "RULE-CVE-2024-2242-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpcf7"}, {"name": "ARGS:action", "type": "equals", "value": "edit"}, {"name": "ARGS:active-tab", "type": "regex", "value": "~(?:]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-2242", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2242", "description": "Contact Form 7 <=5.9 reflected XSS via active-tab parameter on admin edit page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "contact-form-7", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=5.9"}, "RULE-CVE-2024-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/uploads/edd(?:-logs)?/.*\\\\.(?:log|log\\\\.[0-9]+|log\\\\.bak|log\\\\.old)(?:/)?(?:\\\\?|$)~i"}], "cve": "CVE-2024-2302", "method": "GET", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2024-2302-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/uploads/edd(?:-logs)?(?:/)?(?:\\\\?.*)?$~i"}], "cve": "CVE-2024-2302", "method": "GET", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2024-2341-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:keys", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via keys parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:appointment_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via appointment_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:meta_key", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via meta_key parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:customer_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via customer_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:group_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via group_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:booking|appointments?|upcoming_appointments?|admin_app)[^\\\\]]*customer_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|CONCAT)\\\\b|--\\\\s|/\\\\*|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via malicious shortcode customer_id attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:booking|appointments?|upcoming_appointments?|admin_app)[^\\\\]]*group_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|CONCAT)\\\\b|--\\\\s|/\\\\*|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via malicious shortcode group_id attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_[^\\\\]]*customer_id\\\\s*=\\\\s*[\\"\'][^\\"\']*[^\\\\d\\\\s\\"\'\\\\]][^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via non-numeric customer_id shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_[^\\\\]]*group_id\\\\s*=\\\\s*[\\"\'][^\\"\']*[^\\\\d\\\\s\\"\'\\\\]][^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via non-numeric group_id shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2345-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2345", "description": "FileBird <=5.6.3 authenticated (author+) stored XSS via folder name parameter in REST API", "mode": "block", "severity": 6.4, "slug": "filebird", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-2350-01": {"action": "elementor_save", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_save"}, {"name": "ARGS:data", "type": "contains", "value": "\\"widgetType\\":\\"clever-"}, {"name": "ARGS:data", "type": "regex", "value": "~(?i)(]*>|javascript:|onerror\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2350", "description": "Clever Addons for Elementor (cafe-lite) <= 2.1.9 \\u2013 Contributor+ stored XSS via CAFE Icon, CAFE Team Member, and CAFE Slider Elementor widget settings; blocks script-style payloads in widget JSON for users without unfiltered_html.\\n", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cafe-lite", "tags": ["xss", "stored", "elementor", "widgets", "wordpress"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2024-23500-01": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-23500", "description": "Kadence Blocks <=3.2.19 authenticated SSRF via kadence_import_process_image_data AJAX handler", "mode": "block", "severity": 7.7, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-23500-02": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-23500", "description": "Kadence Blocks <=3.2.19 authenticated SSRF via kadence_import_process_pattern AJAX handler", "mode": "block", "severity": 7.7, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-2417-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "user_registration_form_save_action"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2417", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2417", "description": "User Registration <=3.1.5 missing authorization in form_save_action allows subscriber+ privilege escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "user-registration", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.1.5"}, "RULE-CVE-2024-2441-01": {"ajax_action": "vikbooking", "conditions": [{"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2024-2441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2441", "description": "VikBooking <=1.6.7 IDOR via wp_ajax_vikbooking allows authenticated low-privilege users to access admin settings", "method": "POST", "mode": "block", "severity": 8.1, "slug": "vikbooking", "tags": ["idor", "missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2024-24934-01": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"name": "ARGS:library_action", "type": "regex", "value": "~^(delete_library_template|delete_kit|update_kit|import_kit)$~i"}, {"name": "ARGS:source", "type": "regex", "value": "~(^|/|\\\\\\\\|%2f|%5c)(\\\\.\\\\.|%2e%2e)(/|\\\\\\\\|%2f|%5c)~i"}], "cve": "CVE-2024-24934", "mode": "block", "severity": 8.1, "slug": "elementor", "target": "plugin", "versions": "<=3.19.0"}, "RULE-CVE-2024-24934-02": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"name": "ARGS:library_action", "type": "regex", "value": "~^(import_kit|import_template|sync_library)$~i"}, {"name": "ARGS:source", "type": "regex", "value": "~phar://~i"}], "cve": "CVE-2024-24934", "mode": "block", "severity": 8.1, "slug": "elementor", "target": "plugin", "versions": "<=3.19.0"}, "RULE-CVE-2024-25935-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-25935", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.2.5.9"}, "RULE-CVE-2024-2667-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/instawp-connect/v1/config(?:/|\\\\?|&|$)~"}, {"name": "ARGS:override_plugin_zip", "type": "exists"}], "cve": "CVE-2024-2667", "method": "POST", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.22"}, "RULE-CVE-2024-2702-01": {"ajax_action": "olive_demo_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2702", "description": "Olive One Click Demo Import <=1.1.1 missing authorization on demo import allowing unauthenticated stored XSS via olive_demo_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "olive-one-click-demo-import", "tags": ["missing-authorization", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2024-2771-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/managers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "fluentform_full_access"}], "cve": "CVE-2024-2771", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fluentform", "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-2771-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/managers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "fluentform_full_access"}], "cve": "CVE-2024-2771", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "fluentform", "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-2782-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/global-settings(?:[/?]|$)~"}, {"type": "missing_capability", "value": "fluentform_settings_manager"}], "cve": "CVE-2024-2782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2782", "description": "Fluent Forms <=5.1.16 missing authorization on global-settings REST API endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "fluentform", "tags": ["missing-authorization", "rest-api", "unauthorized"], "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-27956-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/plugins/wp-automatic/inc/csv\\\\.php~i"}, {"name": "ARGS:q", "type": "detectSQLi"}], "cve": "CVE-2024-27956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27956", "description": "wp-automatic (Automatic) <=3.92.0 unauthenticated SQL injection via the q parameter of the direct-access inc/csv.php script (CVE-2024-27956, mass-exploited 2024). The script builds a SQL query from the attacker-controlled q parameter after a bypassable auth/integ check. Blocks requests to /wp-content/plugins/wp-automatic/inc/csv.php whose q parameter contains a SQL-injection payload; legitimate CSV-export calls carry a benign q and are unaffected.", "mode": "block", "severity": 9.8, "slug": "wp-automatic", "tags": ["sql-injection", "unauthenticated", "direct-script-access"], "target": "plugin", "versions": "<=3.92.0"}, "RULE-CVE-2024-27987-01": {"action": "init", "conditions": [{"name": "ARGS:form_id", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via form_id parameter in shortcode rendering", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:status", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via status parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:donor", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via donor parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via order parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:status", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via status parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:donor", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via donor parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-11": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via s (search) parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-12": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-13": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-28000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/users(?:/|\\\\?|$|$)~"}, {"name": "REQUEST_COOKIES:litespeed_hash", "type": "exists"}], "cve": "CVE-2024-28000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-28000", "description": "LiteSpeed Cache >=1.9 <=6.3.0.1 unauthenticated privilege escalation via cookie-based role simulation on WP REST /wp/v2/users endpoint (litespeed_hash brute-force)", "mode": "block", "severity": 9.8, "slug": "litespeed-cache", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.9 <=6.3.0.1"}, "RULE-CVE-2024-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[calendar[^\\\\]]*categories\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|GROUP_CONCAT|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|BENCHMARK|SLEEP|OR\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|AND\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|--|;|/\\\\*)[^\\\\]]*[\\\\\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2831", "method": "POST", "mode": "block", "severity": 8.8, "slug": "calendar", "target": "plugin", "versions": "<=1.3.14"}, "RULE-CVE-2024-2831-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[calendar[^\\\\]]*categories\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|GROUP_CONCAT|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|BENCHMARK|SLEEP|OR\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|AND\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|--|;|/\\\\*)[^\\\\]]*[\\\\\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2831", "method": "POST", "mode": "block", "severity": 8.8, "slug": "calendar", "target": "plugin", "versions": "<=1.3.14"}, "RULE-CVE-2024-2876-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:method", "type": "regex", "value": "~^get_matching_recipients_count$~"}, {"name": "ARGS", "type": "regex", "value": "~\'\\\\s*(\\\\)|;|union\\\\b|select\\\\b|insert\\\\b|update\\\\b|delete\\\\b|drop\\\\b|--|#|/\\\\*)|\'\\\\s+(?:or|and)\\\\b~i"}], "cve": "CVE-2024-2876", "description": "SQL injection in Email Subscribers & Newsletters (Icegram Express) <=5.7.14: non-numeric elements of a _click_link condition value are interpolated unescaped into \\"link IN (\'\')\\" in IG_ES_Subscribers_Query::run() (SINK class-ig-es-subscriber-query.php:304; fixed 5.7.15 esc_sql). ENTRYPOINT wp_ajax_nopriv_icegram-express -> ES_Router::handle_ajax_request -> ES_Campaign_Controller::get_matching_recipients_count, payload data[list_conditions][..][value][..].", "method": "POST", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "target": "plugin", "versions": "<=5.7.14"}, "RULE-CVE-2024-29090-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/settings/update(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-29090", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29100-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai(-ui)?/v1/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-29100", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29100-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai(-ui)?/v1/~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-29100", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29113-01": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-02": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-03": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-04": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_sort", "type": "regex", "value": "~^(?!(?:latest|oldest|0toz|zto0)$).+~"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29117-01": {"ajax_action": "accua_form_submit", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~<(?:script|iframe|img|svg)[^>]*>~i"}], "cve": "CVE-2024-29117", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contact-forms", "target": "plugin", "versions": "<=1.7.0"}, "RULE-CVE-2024-29931-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:map_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via map_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:poly_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via poly_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:circle_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via circle_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:rectangle_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via rectangle_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-3020-01": {"ajax_action": "wpcp_import_shortcodes", "conditions": [{"name": "ARGS:shortcode", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3020", "description": "WP Carousel <=2.6.3 authenticated PHP object injection via wpcp_import_shortcodes AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.6.3"}, "RULE-CVE-2024-30226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/betterdocs/faq/(?:create_post|update_post|delete_post|create_category|update_category|delete_category|category_order|update_order_by_category|category_search|category_status|sample_data|uncategorised|posts/)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2024-30226", "description": "BetterDocs <=3.3.3 unauthenticated PHP object injection via FAQBuilder REST API routes", "mode": "block", "severity": 9.0, "slug": "betterdocs", "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-30229-01": {"ajax_action": "give_donation_import", "conditions": [{"name": "ARGS:mapto", "type": "exists"}, {"name": "ARGS:mapto", "type": "regex", "value": "~(?i)O:\\\\+?\\\\d+:\\"[^\\"]*\\":\\\\+?\\\\d+:\\\\{~"}], "cve": "CVE-2024-30229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-30229", "description": "GiveWP <= 3.4.2 \\u2013 PHP Object Injection via mapto in give_donation_import AJAX action (CWE-502, CVSS 7.2)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "give", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-30231-01": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-30231", "description": "Product Import Export for WooCommerce <=2.4.1 authenticated arbitrary file upload via iew_import_ajax_basic AJAX handler \\u2014 missing authorization", "mode": "block", "severity": 9.1, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-30464-01": {"ajax_action": "zoom_ajax_set_pointer_transient", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-30464", "description": "Social Icons Widget & Block by WPZOOM <=4.2.15 missing authorization on zoom_ajax_set_pointer_transient AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-icons-widget-by-wpzoom", "target": "plugin", "versions": "<=4.2.15"}, "RULE-CVE-2024-30485-01": {"ajax_action": "xl_addon_installation", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-30485", "description": "Finale Lite <=2.18.0 subscriber+ arbitrary plugin installation/activation via xl_addon_installation AJAX handler", "mode": "block", "severity": 8.8, "slug": "finale-woocommerce-sales-countdown-timer-discount", "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2024-30501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json)?/download-monitor/v1/~"}, {"name": "ARGS:limit", "type": "detectSQLi"}], "cve": "CVE-2024-30501", "method": "GET", "mode": "block", "severity": 7.2, "slug": "download-monitor", "target": "plugin", "versions": "<=4.9.4"}, "RULE-CVE-2024-30501-02": {"ajax_action": "dlm_top_downloads_reports", "conditions": [{"name": "ARGS:limit", "type": "detectSQLi"}], "cve": "CVE-2024-30501", "method": "POST", "mode": "block", "severity": 7.2, "slug": "download-monitor", "target": "plugin", "versions": "<=4.9.4"}, "RULE-CVE-2024-30516-01": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:scheduleCost", "type": "regex", "value": "~^\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|[+-]?(?:0+(?:\\\\.0*)?|0*\\\\.0+)(?:[eE][+-]?0+)?)\\\\s*$~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-02": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:cost", "type": "regex", "value": "~^\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|[+-]?(?:0+(?:\\\\.0*)?|0*\\\\.0+)(?:[eE][+-]?0+)?)\\\\s*$~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-03": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:guests", "type": "regex", "value": "~\\"cost\\"\\\\s*:\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|0(?:\\\\.0+)?)(?!\\\\.)(?=\\\\s*[,\\\\}\\\\]])~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-04": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:services", "type": "regex", "value": "~\\"cost\\"\\\\s*:\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|0(?:\\\\.0+)?)(?!\\\\.)(?=\\\\s*[,\\\\}\\\\]])~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30549-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "accua-forms-edit"}, {"name": "ARGS:edit-fid", "type": "detectXSS"}], "cve": "CVE-2024-30549", "method": "GET", "mode": "block", "severity": 4.8, "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2024-30549-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "accua-forms-submissions"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2024-30549", "method": "GET", "mode": "block", "severity": 4.8, "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2024-3055-01": {"ajax_action": "unitecreator_elementor_export_template", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-3055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3055", "description": "Unlimited Elements For Elementor <=1.5.102 authenticated (Contributor+) time-based SQL injection via id parameter in export template AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.5.102"}, "RULE-CVE-2024-3055-02": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-3055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3055", "description": "Unlimited Elements For Elementor <=1.5.102 authenticated (Contributor+) time-based SQL injection via id parameter in import template AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.5.102"}, "RULE-CVE-2024-3105-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[[]insert_php([^a-zA-Z0-9_][^]]*|)[]]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3105", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3105", "description": "Starter Templates by suspended developer (Insert PHP) <=2.5.0 authenticated (Contributor+) RCE via insert_php shortcode in post content", "method": "POST", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["remote-code-execution", "shortcode", "missing-authorization"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-3107-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/spectra/v1/editor(?:/|\\\\?|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|\\\\.\\\\.%2f|\\\\.\\\\.%5c|%2e%2e%5c)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3107", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.6"}, "RULE-CVE-2024-31113-01": {"ajax_action": "edd_recapture_remote_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-31113", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2024-3136-01": {"ajax_action": "stm_lms_load_content", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC])~"}], "cve": "CVE-2024-3136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3136", "description": "MasterStudy LMS <=3.3.3 unauthenticated Local File Inclusion via template parameter in stm_lms_load_content AJAX handler", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-3136-02": {"ajax_action": "stm_lms_load_modal", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC])~"}], "cve": "CVE-2024-3136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3136", "description": "MasterStudy LMS <=3.3.3 unauthenticated Local File Inclusion via template parameter in stm_lms_load_modal AJAX handler", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-3161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:jkit[-_]countdown|sg_countdown|sg_expire).*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3161", "description": "Jeg Elementor Kit <=2.6.4 contributor+ stored XSS via countdown widget attributes in Elementor editor save (elementor_ajax)", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-3161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:jkit[-_]countdown|sg_countdown|sg_expire).*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3161", "description": "Jeg Elementor Kit <=2.6.4 contributor+ stored XSS via countdown widget attributes in Elementor REST API document save", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-3211-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ec_addtocart\\\\b[^\\\\]]*productid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CONCAT|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|OR\\\\s+\\\\d|AND\\\\s+\\\\d|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-3211", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3211", "description": "Shopping Cart & eCommerce Store <=5.6.3 SQL Injection via ec_addtocart shortcode productid attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-easycart", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-3211-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ec_addtocart\\\\b[^\\\\]]*productid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CONCAT|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|OR\\\\s+\\\\d|AND\\\\s+\\\\d|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-3211", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3211", "description": "Shopping Cart & eCommerce Store <=5.6.3 SQL Injection via ec_addtocart shortcode productid attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-easycart", "tags": ["sql-injection", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-3217-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:attribute_id", "type": "regex", "value": "~[^0-9a-zA-Z_\\\\-]~"}], "cve": "CVE-2024-3217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3217", "description": "WP Directory Kit <=1.3.0 SQL Injection via attribute_id parameter in wdk_public_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpdirectorykit", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2024-3217-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:attribute_value", "type": "regex", "value": "~[^0-9a-zA-Z_\\\\-]~"}], "cve": "CVE-2024-3217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3217", "description": "WP Directory Kit <=1.3.0 SQL Injection via attribute_value parameter in wdk_public_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpdirectorykit", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2024-32505-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-32505", "description": "ElementsKit Lite <=3.0.6 Contributor+ stored XSS via ekit_admin_action settings injection", "mode": "block", "severity": 6.5, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2024-32567-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "detectXSS"}], "cve": "CVE-2024-32567", "method": "GET", "mode": "block", "severity": 6.1, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2024-3293-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rtmedia_gallery\\\\b[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|\\\\(\\\\s*SELECT)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3293", "method": "POST", "mode": "block", "severity": 8.8, "slug": "buddypress-media", "target": "plugin", "versions": "<=4.6.18"}, "RULE-CVE-2024-3293-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rtmedia_gallery\\\\b[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|\\\\(\\\\s*SELECT)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3293", "method": "POST", "mode": "block", "severity": 8.8, "slug": "buddypress-media", "target": "plugin", "versions": "<=4.6.18"}, "RULE-CVE-2024-3342-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mp-timetable[^\\\\]]*\\\\bevents\\\\s*=\\\\s*(?:[\'\\"][^\'\\"]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\'\\"]*[\'\\"]|[^\\\\s\\\\]]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\\\\s\\\\]]*)~i"}], "cve": "CVE-2024-3342", "mode": "block", "severity": 9.9, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2024-3342-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mp-timetable[^\\\\]]*\\\\bevents\\\\s*=\\\\s*(?:[\'\\"][^\'\\"]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\'\\"]*[\'\\"]|[^\\\\s\\\\]]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\\\\s\\\\]]*)~i"}], "cve": "CVE-2024-3342", "mode": "block", "severity": 9.9, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2024-3343-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~themeisle-blocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on\\\\w+\\\\s*=|<\\\\s*img[^>]*on\\\\w+\\\\s*=)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3343", "description": "Otter Blocks <=2.6.8 contributor+ stored XSS via block attributes in post content", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-3344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:async-upload|media-new)\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|on(?:load|error|click|mouseover|focus|begin|end|activate)\\\\s*=|javascript\\\\s*:|]|on(?:load|error|click|mouseover|focus|begin|end|activate)\\\\s*=|javascript\\\\s*:|]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-33947-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-33947-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-34440-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/upload(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-03-DELETE": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "DELETE", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/list(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-3495-01": {"ajax_action": "tc_csca_get_states", "conditions": [{"name": "ARGS:cnt", "type": "detectSQLi"}], "cve": "CVE-2024-3495", "method": "POST", "mode": "block", "severity": 9.8, "slug": "country-state-city-auto-dropdown", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2024-3495-02": {"ajax_action": "tc_csca_get_cities", "conditions": [{"name": "ARGS:sid", "type": "detectSQLi"}], "cve": "CVE-2024-3495", "method": "POST", "mode": "block", "severity": 9.8, "slug": "country-state-city-auto-dropdown", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2024-3499-01": {"ajax_action": "generate_navigation_markup", "conditions": [{"name": "ARGS:nav_style", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2024-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3499", "description": "ElementsKit Elementor Addons <=3.1.0 authenticated Local File Inclusion via generate_navigation_markup AJAX nav_style parameter", "mode": "block", "severity": 8.8, "slug": "elementskit-lite", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2024-3548-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|].*?on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-3548", "description": "Shortcodes Ultimate <7.1.2 authenticated reflected XSS via shortcode parameter in su_generator_preview AJAX handler", "mode": "block", "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<7.1.2"}, "RULE-CVE-2024-3549-01": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:b2sSortPostType", "type": "detectSQLi"}], "cve": "CVE-2024-3549", "method": "POST", "mode": "block", "severity": 9.9, "slug": "blog2social", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2024-3550-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_(?:lightbox|dailymotion|service|anchor|heading|button|tab|spoiler|accordion|audio|video|animate|tooltip|permalink|members|guests|feed|menu|subpages|siblings|carousel|custom_gallery|slider|gmap|posts)\\\\s[^\\\\]]*(?:on(?:error|load|mouse(?:over|out|enter|move|down|up)|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 stored XSS via shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3550-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_(?:lightbox|dailymotion|service|anchor|heading|button|tab|spoiler|accordion|audio|video|animate|tooltip|permalink|members|guests|feed|menu|subpages|siblings|carousel|custom_gallery|slider|gmap|posts)\\\\s[^\\\\]]*(?:on(?:error|load|mouse(?:over|out|enter|move|down|up)|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 stored XSS via shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3550-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|mouse(?:over|out|enter)|focus|blur|click|dblclick)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 reflected XSS via su_generator_preview AJAX shortcode parameter", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3552-01": {"ajax_action": "w2dc_get_map_marker_info", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.+\\\\s+FROM|AND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|OR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+)~"}], "cve": "CVE-2024-3552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3552", "description": "Web Directory Free <=1.6.9 unauthenticated SQL injection via locations_ids parameter in w2dc_get_map_marker_info AJAX handler", "mode": "block", "severity": 9.8, "slug": "web-directory-free", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2024-3560-01": {"action": "init", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-3560-02": {"action": "init", "conditions": [{"name": "ARGS:c_level", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-3560-03": {"action": "init", "conditions": [{"name": "ARGS:c_authors", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-35683-01": {"ajax_action": "send-card-check", "conditions": [{"name": "ARGS:donation_id", "type": "exists"}], "cve": "CVE-2024-35683", "method": "POST", "mode": "block", "severity": 5.3, "slug": "leyka", "target": "plugin", "versions": "<=3.31.1"}, "RULE-CVE-2024-35690-01": {"ajax_action": "widgetopts_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_users AJAX handler (Subscriber+ User Meta Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-35690-02": {"ajax_action": "widgetopts_get_settings_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_settings_ajax AJAX handler (Subscriber+ Settings Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-35690-03": {"ajax_action": "widgetopts_get_legacy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_legacy_data AJAX handler (Subscriber+ Legacy Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-3592-01": {"ajax_action": "qsm_bulk_delete_question_from_database", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "delete_published_posts"}], "cve": "CVE-2024-3592", "method": "POST", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "target": "plugin", "versions": "<=9.0.1"}, "RULE-CVE-2024-3592-02": {"ajax_action": "qsm_delete_question_from_database", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "delete_published_posts"}], "cve": "CVE-2024-3592", "method": "POST", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "target": "plugin", "versions": "<=9.0.1"}, "RULE-CVE-2024-3605-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wphb/v1/rooms/search-rooms(/|\\\\?|&|$)~"}, {"name": "ARGS:room_type", "type": "detectSQLi"}], "cve": "CVE-2024-3605", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-hotel-booking", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-37099-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "exists"}, {"name": "ARGS:give-form-title", "type": "regex", "value": "~[OaCd]:[0-9]+:~i"}], "cve": "CVE-2024-37099", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-3715-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "contact-form-listings"}, {"name": "ARGS:start_date", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+on[a-zA-Z]+\\\\s*=|]|]|])~i"}], "cve": "CVE-2024-3715", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3715", "description": "Database for Contact Form 7 <=1.3.8 reflected XSS via start_date parameter on admin leads page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "contact-form-entries", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-3715-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "contact-form-listings"}, {"name": "ARGS:end_date", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+on[a-zA-Z]+\\\\s*=|]|]|])~i"}], "cve": "CVE-2024-3715", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3715", "description": "Database for Contact Form 7 <=1.3.8 reflected XSS via end_date parameter on admin leads page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "contact-form-entries", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-3725-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~themeisle-blocks/posts-grid[^}]*\\"titleTag\\"\\\\s*:\\\\s*\\"(?!h[1-6]\\")[^\\"]*(?:<|on[a-z]+=|javascript:|%3[Cc])~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3725", "description": "Otter Blocks <=2.6.9 stored XSS via Post Grid widget titleTag block attribute", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.9"}, "RULE-CVE-2024-3728-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:actions", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3728", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3728-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:elements", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3728", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3729-03": {"ajax_action": "frontend_admin/form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author)$~i"}], "cve": "CVE-2024-3729", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2024-3729-04": {"ajax_action": "frontend_admin/validate_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author)$~i"}], "cve": "CVE-2024-3729", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2024-37489-01": {"ajax_action": "owp_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_name in owp_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-02": {"ajax_action": "owp_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_type in owp_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-03": {"ajax_action": "owp_wizard_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_name in owp_wizard_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-04": {"ajax_action": "owp_wizard_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]|])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_type in owp_wizard_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37517-01": {"ajax_action": "ast-block-templates-regenerate", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37517-02": {"ajax_action": "ast-block-templates-ai-content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37517-03": {"ajax_action": "ast-block-templates-reset-business-details", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-3820-01": {"ajax_action": "wdt_delete_table_row", "conditions": [{"name": "ARGS:id_key", "type": "detectSQLi"}], "cve": "CVE-2024-3820", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.1"}, "RULE-CVE-2024-3821-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_table_config AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_plugin_settings AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-03": {"ajax_action": "wpdatatables_duplicate_table", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_duplicate_table AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-04": {"ajax_action": "wpdatatables_create_simple_table", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_create_simple_table AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-05": {"ajax_action": "wpdatatables_save_simple_table_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_simple_table_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-06": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_save_chart_get_shortcode AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-07": {"ajax_action": "wpdatatables_duplicate_chart", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_duplicate_chart AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-08": {"ajax_action": "wpdatatables_get_handsontable_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_handsontable_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-09": {"ajax_action": "wpdatatables_get_columns_data_by_table_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_columns_data_by_table_id AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-10": {"ajax_action": "wpdatatables_delete_log_errors_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_delete_log_errors_cache AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-11": {"ajax_action": "wpdatatable_list_all_tables", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_list_all_tables AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-12": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_show_chart_from_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-13": {"ajax_action": "wpdatatable_list_all_charts", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_list_all_charts AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-14": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_nested_json_roots AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-38755-01": {"ajax_action": "directorypress_fields_edit_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_edit_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-02": {"ajax_action": "directorypress_fields_edit_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_edit_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-03": {"ajax_action": "directorypress_fields_config_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_config_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-04": {"ajax_action": "directorypress_fields_options_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_options_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-05": {"ajax_action": "directorypress_fields_search_settings_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_search_settings_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-06": {"ajax_action": "directorypress_fields_search_settings_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_search_settings_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-07": {"ajax_action": "directorypress_fields_group_edit_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_edit_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-08": {"ajax_action": "directorypress_fields_group_edit_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_edit_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-09": {"ajax_action": "directorypress_fields_delete_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_delete_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-10": {"ajax_action": "directorypress_fields_group_delete_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_delete_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-11": {"ajax_action": "directorypress_terms_configuration_html", "conditions": [{"name": "ARGS:term_id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via term_id parameter in directorypress_terms_configuration_html AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38791-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleVisionQuery(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|ldap|tftp|ssh2)://|^https?://(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|localhost|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|\\\\[::1\\\\]|0177\\\\.0\\\\.0\\\\.1|2130706433|0x7f000001|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2024-38791", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-38791-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleVisionQuery(/|\\\\?|$)~i"}, {"name": "ARGS:path", "type": "exists"}], "cve": "CVE-2024-38791", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-38793-01": {"ajax_action": "brm_edit_group", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_edit_group AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-02": {"ajax_action": "brm_delete_group", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_delete_group AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-03": {"ajax_action": "brm_edit_item", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_edit_item AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-04": {"ajax_action": "brm_delete_item", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_delete_item AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-05": {"ajax_action": "brm_save_group", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_save_group allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-06": {"ajax_action": "brm_save_item", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_save_item allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-07": {"ajax_action": "brm_order_nesting_groups_items", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_order_nesting_groups_items allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-3894-01": {"ajax_action": "robo_gallery_get_images_from_ids", "conditions": [{"name": "ARGS:idstring", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2024-3894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3894", "description": "Robo Gallery <=3.2.19 stored XSS via idstring parameter in robo_gallery_get_images_from_ids AJAX handler", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-3954-01": {"ajax_action": "ditty_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\\\"[^\\\\\\"]+\\\\\\":[0-9]+:~"}], "cve": "CVE-2024-3954", "description": "Ditty News Ticker <=3.1.38 authenticated PHP object injection via ditty_init AJAX handler", "mode": "block", "severity": 8.8, "slug": "ditty-news-ticker", "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2024-39635-01": {"ajax_action": "youzify_admin_data_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-39635", "method": "POST", "mode": "block", "severity": 5.4, "slug": "youzify", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2024-39635-02": {"ajax_action": "youzify_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-39635", "method": "POST", "mode": "block", "severity": 5.4, "slug": "youzify", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2024-39643-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-39643-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-39643-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-4010-03": {"ajax_action": "ig_es_get_subscribers_stats", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4010", "description": "Email Subscribers <=5.7.19 subscriber+ unauthorized access to subscriber stats via ig_es_get_subscribers_stats", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=5.7.19"}, "RULE-CVE-2024-4010-04": {"ajax_action": "ig_es_trigger_mailing_queue_sending", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4010", "description": "Email Subscribers <=5.7.19 missing authorization on mailing queue trigger via ig_es_trigger_mailing_queue_sending", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.7.19"}, "RULE-CVE-2024-4033-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "aiovg_videos"}, {"name": "ARGS:image", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\?|#|$)|\\\\.htaccess(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-4033", "description": "All-in-One Video Gallery <=3.6.4 authenticated (contributor+) arbitrary file upload via image parameter in aiovg_videos post save", "mode": "block", "severity": 8.8, "slug": "all-in-one-video-gallery", "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2024-4095-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:expand|colomat|expandsub[0-9]{1,2})\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|%\\\\(%[^%]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4095", "description": "Collapse-O-Matic <=1.8.5.7 contributor+ stored XSS via expand/expandsub/colomat shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "jquery-collapse-o-matic", "target": "plugin", "versions": "<=1.8.5.7"}, "RULE-CVE-2024-4095-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:expand|colomat|expandsub[0-9]{1,2})\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|%\\\\(%[^%]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4095", "description": "Collapse-O-Matic <=1.8.5.7 contributor+ stored XSS via expand/expandsub/colomat shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "jquery-collapse-o-matic", "target": "plugin", "versions": "<=1.8.5.7"}, "RULE-CVE-2024-4098-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shariff/v1/share_counts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:services", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2024-4098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4098", "description": "Shariff Wrapper <=4.6.13 unauthenticated Local File Inclusion via services parameter in REST API share_counts endpoint", "method": "GET", "mode": "block", "severity": 9.8, "slug": "shariff", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.6.13"}, "RULE-CVE-2024-4160-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm[_-](?:all[_-]packages|categories)[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4160", "description": "Download Manager <=3.2.90 stored XSS via wpdm-all-packages shortcode attributes", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.90"}, "RULE-CVE-2024-4180-01": {"ajax_action": "tribe_events_views_v2_fallback", "conditions": [{"name": "ARGS:view", "type": "equals", "value": "reflector"}], "cve": "CVE-2024-4180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4180", "description": "The Events Calendar <=6.4.0 reflected XSS via view=reflector in AJAX fallback handler (POST)", "method": "POST", "mode": "block", "severity": 9.1, "slug": "the-events-calendar", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.4.0"}, "RULE-CVE-2024-4180-02": {"ajax_action": "tribe_events_views_v2_fallback", "conditions": [{"name": "ARGS:view", "type": "equals", "value": "reflector"}], "cve": "CVE-2024-4180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4180", "description": "The Events Calendar <=6.4.0 reflected XSS via view=reflector in AJAX fallback handler (GET)", "method": "GET", "mode": "block", "severity": 9.1, "slug": "the-events-calendar", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.4.0"}, "RULE-CVE-2024-4223-01": {"ajax_action": "addon_enable_disable", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on addon_enable_disable AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-02": {"ajax_action": "tutor_get_all_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_get_all_addons AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-03": {"ajax_action": "tutor_course_delete", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_course_delete AJAX action allowing arbitrary course deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-04": {"ajax_action": "tutor_announcement_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_announcement_create AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-05": {"ajax_action": "tutor_announcement_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_announcement_delete AJAX action allowing arbitrary announcement deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-06": {"ajax_action": "delete_tutor_review", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on delete_tutor_review AJAX action allowing arbitrary review deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tutor/v1/course-by-terms(/|\\\\?|&|$)~"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 unauthorized access to removed REST route /tutor/v1/course-by-terms", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4277-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:_elementor_data", "type": "detectXSS"}], "cve": "CVE-2024-4277", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4295-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:hash", "type": "regex", "value": "~(?:\'|%27|%2527)[\\\\s)]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|\\\\d\\\\s*[=<>])~i"}], "cve": "CVE-2024-4295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4295", "description": "Email Subscribers by Icegram Express <=5.7.20 unauthenticated SQL injection via hash parameter on icegram-express AJAX handler", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7.20"}, "RULE-CVE-2024-43141-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2024-43141", "description": "Participants Database <=2.5.9.2 unauthenticated PHP object injection via unsanitized cookie deserialization in pdb_list_filter AJAX handler", "mode": "block", "severity": 9.8, "slug": "participants-database", "target": "plugin", "versions": "<=2.5.9.2"}, "RULE-CVE-2024-43160-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optifer/v1/store-webp(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43160", "description": "BerqWP <=1.7.6 unauthenticated arbitrary file upload via optifer/v1/store-webp REST route", "method": "POST", "mode": "block", "severity": 10.0, "slug": "searchpro", "tags": ["missing-authorization", "arbitrary-file-upload", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2024-43162-01": {"ajax_action": "edd_customer_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-02": {"ajax_action": "edd_customer_addresses", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-03": {"ajax_action": "edd_search_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-04": {"ajax_action": "edd_customer_search", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-4318-01": {"ajax_action": "review_quiz_answer", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|(?:^|[\\\\s\'\\"])(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+)~i"}], "cve": "CVE-2024-4318", "description": "Tutor LMS <=2.7.0 authenticated (Instructor+) time-based SQL injection via question_id in review_quiz_answer AJAX handler", "mode": "block", "severity": 6.5, "slug": "tutor", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-43302-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "reset"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit reset action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43302-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "disable"}, {"name": "ARGS:kit_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit disable action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43302-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "enable"}, {"name": "ARGS:kit_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit enable action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43304-01": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:requiredCurrencies", "type": "detectXSS"}], "cve": "CVE-2024-43304", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-43314-01": {"action": "admin_post", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43314", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-asset-clean-up", "target": "plugin", "versions": "<=1.3.9.3"}, "RULE-CVE-2024-43328-01": {"ajax_action": "get_viewer", "conditions": [{"name": "ARGS:fid", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2024-43328", "description": "EmbedPress <=4.0.9 unauthenticated PHP local file inclusion via fid parameter in get_viewer AJAX handler", "mode": "block", "severity": 9.8, "slug": "embedpress", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2024-43328-02": {"ajax_action": "youtube_rest_api", "conditions": [{"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43328", "description": "EmbedPress <=4.0.9 unauthenticated access to youtube_rest_api AJAX handler (nopriv removed in patch)", "mode": "block", "severity": 9.8, "slug": "embedpress", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2024-4334-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~dsm_typing_effect[^\\\\]]*typing_cursor\\\\s*=\\\\s*(?:\\"[^\\"]*|\'[^\']*|[^\\\\s\\\\]]*)(?:]|on(?:error|load|mouseover|click|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4334", "description": "Supreme Modules Lite <=2.5.3 contributor+ DOM-Based Stored XSS via typing_cursor in TypingEffect module shortcode", "mode": "block", "severity": 6.4, "slug": "supreme-modules-for-divi", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2024-4347-01": {"ajax_action": "wpfc_delete_cache", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2024-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4347", "description": "WP Fastest Cache <=1.2.6 authenticated arbitrary file deletion via path traversal in wpfc_delete_cache", "mode": "block", "severity": 7.2, "slug": "wp-fastest-cache", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2024-4362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new|admin-ajax)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[siteorigin_widget\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\\"\\\\s+[a-z])|\'[^\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\'\\\\s+[a-z])|[^\\\\s\\\\]\\"\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2024-4362", "description": "SiteOrigin Widgets Bundle <=1.60.0 contributor+ stored XSS via siteorigin_widget shortcode class attribute (post.php save path)", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.60.0"}, "RULE-CVE-2024-4362-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[siteorigin_widget\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\\"\\\\s+[a-z])|\'[^\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\'\\\\s+[a-z])|[^\\\\s\\\\]\\"\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2024-4362", "description": "SiteOrigin Widgets Bundle <=1.60.0 contributor+ stored XSS via siteorigin_widget shortcode in REST post update", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.60.0"}, "RULE-CVE-2024-4366-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:block_id", "type": "detectXSS"}], "cve": "CVE-2024-4366", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2024-4366-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:block_id", "type": "detectXSS"}], "cve": "CVE-2024-4366", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2024-4375-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ms_layer\\\\b[^\\\\]]*css_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on\\\\w+\\\\s*=|]|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4375", "description": "Master Slider <=3.9.10 contributor+ stored XSS via ms_layer shortcode css_id attribute", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.9.10"}, "RULE-CVE-2024-43924-01": {"ajax_action": "save-attachment-compat", "conditions": [{"name": "ARGS:attachment_ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-43924-02": {"ajax_action": "rl-folders-move-attachments", "conditions": [{"name": "ARGS:attachment_ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-43924-03": {"ajax_action": "rl-deactivate-plugin", "conditions": [{"name": "ARGS:section", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-4397-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/(?:material/)?item-materials/[0-9]+(?:/|\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|jsp|as(?:p|px)|exe|sh|bat)$~i"}], "cve": "CVE-2024-4397", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4397", "description": "LearnPress <=4.2.6.5 authenticated arbitrary file upload via REST item-materials endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-43977-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"video_date\\" *: *\\"[^\\"]*(?:\\\\\\\\\\"[^\\"]*?(?:on[a-zA-Z0-9_]+ *=|autofocus|style *=|src *=|href *=)|[<>])~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via video_date in tp-video-player widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"carousel_direction\\" *: *\\"[^\\"]*[ =<>]~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via carousel_direction in tp-testimonial-listout widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"res_width_value\\" *: *\\"[^\\"]*\'~"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via res_width_value in tp-page-scroll widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"nav_dots_tooltips\\" *: *\\"[^\\"]*\'(?: {0,3}(?:on[a-zA-Z0-9_]+ *=|style *=|src *=|href *=)| *autofocus(?:[ /]|$)|><)~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via nav_dots_tooltips in tp-page-scroll widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-4413-01": {"action": "init", "conditions": [{"name": "ARGS:mphb_rooms_details", "type": "regex", "value": "~[OC]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-4413", "method": "POST", "mode": "block", "severity": 9.8, "slug": "motopress-hotel-booking-lite", "target": "plugin", "versions": "<=4.11.1"}, "RULE-CVE-2024-4434-01": {"action": "init", "conditions": [{"name": "ARGS:term_id", "type": "exists"}, {"name": "ARGS:term_id", "type": "detectSQLi"}], "cve": "CVE-2024-4434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4434", "description": "LearnPress <= 4.2.6.5 unauthenticated time-based SQL injection via term_id in public course/category listings (Wordfence/NVD: term_id SQLi, unauthenticated, CWE-89)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "learnpress", "tags": ["sqli", "unauth", "learnpress", "term_id"], "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~listingfields(?:%5[Bb]|\\\\[)(?![0-9]+(?:%5[Dd]|\\\\]))~"}], "cve": "CVE-2024-4443", "method": "GET", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4443-02": {"action": "init", "conditions": [{"name": "ARGS:listingfields", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT)|(?:SELECT\\\\s+.+FROM)|(?:INSERT\\\\s+INTO)|(?:DELETE\\\\s+FROM)|(?:UPDATE\\\\s+.+SET)|(?:DROP\\\\s+TABLE)|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE)~"}], "cve": "CVE-2024-4443", "method": "POST", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4443-03": {"action": "init", "conditions": [{"name": "ARGS:listingfields", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT)|(?:SELECT\\\\s+.+FROM)|(?:INSERT\\\\s+INTO)|(?:DELETE\\\\s+FROM)|(?:UPDATE\\\\s+.+SET)|(?:DROP\\\\s+TABLE)|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE)~"}], "cve": "CVE-2024-4443", "method": "GET", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4444-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "checkout"}, {"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4444-02": {"ajax_action": "learnpress-checkout", "conditions": [{"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4444-03": {"ajax_action": "learnpress_checkout", "conditions": [{"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4470-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ms_slide_info\\\\b[^\\\\]]*tag_name\\\\s*=\\\\s*[\\"\']?(?!(?:h[1-4]|div|span)[\\"\'\\\\s\\\\]])[^\\"\'\\\\]]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4470", "description": "Master Slider <=3.9.9 stored XSS via ms_slide_info shortcode tag_name attribute", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.9.9"}, "RULE-CVE-2024-4489-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:async-upload\\\\.php|media-new\\\\.php)~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~<(?:script[\\\\s/>]|[^>]*\\\\bon(?:load|error|click|mouseover|focus)\\\\s*=|foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-4489", "description": "Royal Elementor Addons <=1.3.976 stored XSS via malicious SVG file upload through async-upload.php", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.3.976"}, "RULE-CVE-2024-4489-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~<(?:script[\\\\s/>]|[^>]*\\\\bon(?:load|error|click|mouseover|focus)\\\\s*=|foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-4489", "description": "Royal Elementor Addons <=1.3.976 stored XSS via malicious SVG file upload through REST media endpoint", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.3.976"}, "RULE-CVE-2024-4560-01": {"ajax_action": "chatbot_chatgpt_upload_file_to_assistant", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-4560", "method": "POST", "mode": "block", "severity": 9.8, "slug": "chatbot-chatgpt", "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2024-4624-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:eael_ext_toc_title_tag", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|(?:^|[\\\\s/])on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-4624", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.20"}, "RULE-CVE-2024-4711-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*button_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode button_label attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*container_type\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode container_type attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode class attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ajax_load_more\\\\b[^\\\\]]*\\\\b(?:button_label|container_type|css_classes)\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+onerror\\\\s*=|]+onload\\\\s*=|])~i"}], "cve": "CVE-2024-4971", "description": "LearnPress <=4.2.6.6 reflected XSS via id parameter in admin question editor", "mode": "block", "severity": 6.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.6"}, "RULE-CVE-2024-5020-01": {"ajax_action": "accordion_slider_save_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-5020-02": {"ajax_action": "accordion_slider_preview_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-5020-03": {"ajax_action": "accordion_slider_import_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-50413-01": {"ajax_action": "acui_email_template_selected", "conditions": [{"name": "ARGS:template_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_email_template_selected", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50413-02": {"ajax_action": "acui_send_test_email", "conditions": [{"name": "ARGS:mail_options_subject", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_send_test_email", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50413-03": {"ajax_action": "acui_mail_options_remove_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_mail_options_remove_attachment", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50477-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/.*activate-new-password(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50477", "description": "Stacks Mobile App Builder <=5.2.3 unauthenticated account takeover via forgot-password REST endpoint missing permission_callback", "method": "POST", "mode": "block", "severity": 9.8, "slug": "stacks-mobile-app-builder", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-50477-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/avaris-wc-rest/v3/receive_builder_image(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)$|\\\\.htaccess$~i"}], "cve": "CVE-2024-50477", "description": "Stacks Mobile App Builder <=5.2.3 unauthenticated arbitrary file upload via receive_builder_image REST endpoint missing permission_callback", "method": "POST", "mode": "block", "severity": 9.8, "slug": "stacks-mobile-app-builder", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-50500-01": {"ajax_action": "auxin_templates_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_templates_data AJAX handler allowing subscriber+ access to demo importer", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-02": {"ajax_action": "auxin_demo_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_demo_data AJAX handler allowing subscriber+ demo import", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-03": {"ajax_action": "import_step", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on import_step AJAX handler allowing subscriber+ demo import step execution", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-04": {"ajax_action": "auxin_template_control_importer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_template_control_importer AJAX handler allowing subscriber+ template control", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-05": {"ajax_action": "aux_ajax_lightbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_ajax_lightbox AJAX handler allowing subscriber+ access with XSS via preview param", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control", "xss"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-06": {"ajax_action": "aux_setup_plugins", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_setup_plugins AJAX handler allowing subscriber+ plugin installation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-07": {"ajax_action": "aux_step_manager", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_step_manager AJAX handler allowing subscriber+ setup wizard access", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-08": {"ajax_action": "aux_ajax_uninstall", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_ajax_uninstall AJAX handler allowing subscriber+ plugin uninstall actions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-09": {"ajax_action": "auxin_customizer_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_customizer_import AJAX handler allowing subscriber+ customizer import", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-5090-01": {"ajax_action": "so_widgets_links_get_title", "conditions": [{"name": "ARGS:postId", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|marquee|body|input|form)\\\\b|&#x?[0-9a-f]+;?\\\\s*<|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-5090", "description": "SiteOrigin Widgets Bundle <=1.61.1 reflected XSS via postId in so_widgets_links_get_title AJAX handler (DCA-confirmed taint flow base/base.php:391->392).", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.61.1"}, "RULE-CVE-2024-5147-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2024-5147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5147", "description": "WPZOOM Addons for Elementor <=1.1.37 unauthenticated Local File Inclusion via path traversal in posts_data JSON parameter on wpz_posts_grid_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpzoom-elementor-addons", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2024-51667-01": {"ajax_action": "paytium_emails_attachments", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-51667", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paytium", "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2024-51793-01": {"ajax_action": "wc_upload_file_ajax", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2024-51793", "description": "Block unauthenticated arbitrary file upload via wc_upload_file_ajax AJAX handler in RepairBuddy plugin (CWE-434). The handler registers both wp_ajax and wp_ajax_nopriv hooks with no authentication, nonce, or file-type validation, allowing anonymous PHP web shell upload leading to RCE. This rule blocks any request carrying a file upload to that endpoint, since the nopriv hook means no legitimate unauthenticated use case exists for this dangerous upload handler.", "mode": "block", "severity": 10.0, "slug": "computer-repair-shop", "target": "plugin", "versions": "<=3.8115"}, "RULE-CVE-2024-5222-01": {"ajax_action": "responsive-ready-sites-import-xml", "conditions": [{"name": "ARGS:xml_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via WXR import xml_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-5222-02": {"ajax_action": "responsive-ready-sites-import-sites", "conditions": [{"name": "ARGS:site_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via site template import site_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-5222-03": {"ajax_action": "responsive-ready-sites-import-wpforms", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via wpforms import form_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-52500-01": {"ajax_action": "create_zone", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on create_zone AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-02": {"ajax_action": "update_logged_in_disabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_logged_in_disabled AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-03": {"ajax_action": "update_zone_enabled_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_zone_enabled_option AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-04": {"ajax_action": "update_zone_id_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_zone_id_option AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-5266-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdm_(?:packages|package|user_dashboard|search_result|tag)\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5266", "description": "Download Manager <=3.2.92 contributor+ stored XSS via wpdm shortcode attributes in post_content (classic editor)", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.92"}, "RULE-CVE-2024-5266-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_(?:packages|package|user_dashboard|search_result|tag)\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5266", "description": "Download Manager <=3.2.92 contributor+ stored XSS via wpdm shortcode attributes in post content (Gutenberg REST API)", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.92"}, "RULE-CVE-2024-5317-01": {"ajax_action": "tnp", "conditions": [{"name": "ARGS:na", "type": "regex", "value": "~^(?:s|ps|profile-save|profile_export)$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:svg|img|iframe|video|audio|object|embed|details|marquee|body)\\\\b)~i"}], "cve": "CVE-2024-5317", "description": "Newsletter <=8.3.4 unauthenticated stored XSS via np1/np-family profile fields on tnp AJAX action", "mode": "block", "severity": 6.1, "slug": "newsletter", "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2024-5317-02": {"action": "init", "conditions": [{"name": "ARGS:na", "type": "regex", "value": "~^(?:s|ps|profile-save|profile_export)$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:svg|img|iframe|video|audio|object|embed|details|marquee|body)\\\\b)~i"}], "cve": "CVE-2024-5317", "description": "Newsletter <=8.3.4 unauthenticated stored XSS via np1/np-family profile fields on public subscribe form (newsletter_action)", "mode": "block", "severity": 6.1, "slug": "newsletter", "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2024-5324-01": {"ajax_action": "xoo_admin_settings_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-5324", "mode": "block", "severity": 8.8, "slug": "mobile-login-woocommerce", "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-5329-01": {"ajax_action": "unitecreator_elementor_get_categories", "conditions": [{"name": "ARGS:data[addonID]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|\\\\bOR\\\\b\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-5329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5329", "description": "Unlimited Elements for Elementor <=1.5.109 authenticated (contributor+) blind SQL injection via data[addonID]", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=1.5.109"}, "RULE-CVE-2024-5349-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:map_style", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~i"}], "cve": "CVE-2024-5349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5349", "description": "LA-Studio Element Kit for Elementor <=1.3.8.1 Local File Inclusion via map_style parameter in Google Maps widget", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.3.8.1"}, "RULE-CVE-2024-54268-01": {"ajax_action": "so_widgets_search_posts", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "so_widgets_search_posts"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-54268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-54268", "description": "Broken access control in SiteOrigin Widgets Bundle so_widgets_search_posts AJAX action allowing low-privileged users to trigger privileged widget searches via admin-ajax.php", "mode": "block", "severity": 8.8, "slug": "so-widgets-bundle", "tags": ["wordpress", "ajax", "missing_authorization", "broken_access_control"], "target": "plugin", "versions": "<=1.64.0"}, "RULE-CVE-2024-54282-01": {"ajax_action": "wpmm_nav_menu_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_nav_menu_save AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-02": {"ajax_action": "wpmm_save_layout", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_save_layout AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-03": {"ajax_action": "wpmm_save_widget", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_save_widget AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-04": {"ajax_action": "wpmm_menu_item_option_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_menu_item_option_save AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-05": {"ajax_action": "wpmm_theme_delete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_theme_delete AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-06": {"ajax_action": "export_wpmm_theme", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via export_wpmm_theme AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^wp-megamenu(?:-import|-export|-themes|-settings)?$~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wp-megamenu admin import/export pages (CWE-502)", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-5441-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:mec[featured_image]", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|t)|shtml?|cgi|fcgi|asp|aspx|jsp|exe|bash|ht(?:access|passwd))(?:[?#/]|$)~i"}], "cve": "CVE-2024-5441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5441", "description": "Modern Events Calendar Lite <=6.5.6 arbitrary file upload via mec[featured_image] URL parameter in wp_ajax(_nopriv)_mec_fes_form \\u2014 set_featured_image() downloads attacker URL unchecked (CWE-434)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "modern-events-calendar-lite", "target": "plugin", "versions": "<=6.5.6"}, "RULE-CVE-2024-5450-01": {"action": "init", "conditions": [{"name": "ARGS:new-bug-title", "type": "exists"}, {"name": "FILES:attachimage", "type": "exists"}], "cve": "CVE-2024-5450", "method": "POST", "mode": "block", "severity": 9.1, "slug": "bug-library", "target": "plugin", "versions": "<2.1.1"}, "RULE-CVE-2024-5501-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~button_(?:one|two)_id\\\\s*=\\\\s*(?:\\"|%22)(?:[^\\"]*?)(?:on(?:mouse(?:over|enter|leave|down|up|move)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run))|(?:]|%(?:20|3[Ee]|2[Ff]))|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5501", "description": "Supreme Modules Lite <=2.5.51 contributor+ stored XSS via button_one_id/button_two_id shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "supreme-modules-for-divi", "target": "plugin", "versions": "<=2.5.51"}, "RULE-CVE-2024-5522-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video/v1/singlevideo~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s+\'|--\\\\s*$)~i"}], "cve": "CVE-2024-5522", "description": "Blocks unauthenticated SQL injection via the \'id\' parameter on the REST route /wp-json/video/v1/singlevideo. The vulnerable plugin passes the id parameter to a SQL query without sanitization or use of $wpdb->prepare(). The fix applies input validation/sanitization. This rule detects SQL injection payloads in the id parameter on the public REST endpoint.", "mode": "block", "severity": 6.5, "slug": "html5-video-player", "target": "plugin", "versions": "<2.5.27"}, "RULE-CVE-2024-56226-01": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|keygen|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_ajax_search_link_target parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_no_results", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_no_results parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-03": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_view_result_text parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-04": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_number_of_words parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56276-01": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-56276", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.9.2.2"}, "RULE-CVE-2024-56288-01": {"ajax_action": "wpdocs_update_option", "conditions": [{"name": "ARGS:wpd_home_id", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-56288-02": {"ajax_action": "wpdocs_update_option", "conditions": [{"name": "ARGS:wpd_get_permalink", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-56288-03": {"ajax_action": "wpdocs_update_folder", "conditions": [{"name": "ARGS:new_name", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-5667-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5756-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:db", "type": "detectSQLi"}], "cve": "CVE-2024-5756", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5756", "description": "Email Subscribers by Icegram Express <=5.7.23 unauthenticated SQL injection via db parameter in icegram-express AJAX handler", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "tags": ["sql-injection", "unauthenticated", "time-based-sqli"], "target": "plugin", "versions": "<=5.7.23"}, "RULE-CVE-2024-5853-01": {"ajax_action": "sirv_upload_file_by_chanks", "conditions": [{"name": "ARGS:partFileName", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)~i"}], "cve": "CVE-2024-5853", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sirv", "target": "plugin", "versions": "<=7.2.6"}, "RULE-CVE-2024-5901-01": {"ajax_action": "so_widgets_setting_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:load|error|click|mouseover|mouseout|focus|blur|submit|change|input|keydown|keyup|keypress|toggle|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|<\\\\s*(?:iframe|svg|img|object|embed|form|math|video|audio|source|details|marquee|body|style|link|meta|base)[\\\\s/>]|srcdoc\\\\s*=|formaction\\\\s*=)~i"}], "cve": "CVE-2024-5901", "description": "SiteOrigin Widgets Bundle <=1.62.2 contributor+ stored XSS in Image Grid widget via so_widgets_setting_save instance attributes", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.62.2"}, "RULE-CVE-2024-5901-02": {"ajax_action": "so_widgets_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:load|error|click|mouseover|mouseout|focus|blur|submit|change|input|keydown|keyup|keypress|toggle|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|<\\\\s*(?:iframe|svg|img|object|embed|form|math|video|audio|source|details|marquee|body|style|link|meta|base)[\\\\s/>]|srcdoc\\\\s*=|formaction\\\\s*=)~i"}], "cve": "CVE-2024-5901", "description": "SiteOrigin Widgets Bundle <=1.62.2 contributor+ stored XSS in Image Grid widget via so_widgets_preview instance attributes", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.62.2"}, "RULE-CVE-2024-5932-02": {"action": "init", "conditions": [{"name": "ARGS:give_title", "type": "exists"}, {"name": "ARGS:give_title", "type": "regex", "value": "~(^|;)O:[0-9]+:\\\\\\"[A-Za-z0-9_\\\\\\\\]+\\\\\\\\TCPDF\\\\\\":~"}], "cve": "CVE-2024-5932", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-5940-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "POST", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "POST", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5941-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/give-api/v2/donor-dashboard/avatar(?:/|\\\\?|$)|(?:^|[?&])rest_route=/give-api/v2/donor-dashboard/avatar)~i"}, {"name": "ARGS:avatarId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5941", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-5977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-6028-01": {"action": "init", "conditions": [{"name": "ARGS:ays_questions", "type": "regex", "value": "~(?:[^0-9, ].*[^0-9, ]|(?:UNION|SELECT|SLEEP|BENCHMARK|OR|AND|INSERT|UPDATE|DELETE|DROP|CONCAT|CHAR|0x[0-9a-fA-F]{2}|/\\\\*|\\\\*/|--)\\\\s)~i"}], "cve": "CVE-2024-6028", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.5.8.3"}, "RULE-CVE-2024-6088-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/learnpress/v1/(?:users/)?register(?:[/?&#]|$)|[?&]rest_route=/learnpress/v1/(?:users/)?register(?:[/?&#]|$))~i"}], "cve": "CVE-2024-6088", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.1"}, "RULE-CVE-2024-6265-01": {"action": "init", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by parameter on front-end users page", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6265-02": {"ajax_action": "uwp_ajax_user_sorting_action", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by on AJAX user sorting handler", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection", "ajax"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6328-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6328-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login_v2(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6330-01": {"ajax_action": "gmw_info_window_init", "conditions": [{"name": "ARGS:form[info_window_template][content_path]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[a-z]+://|^/)~i"}], "cve": "CVE-2024-6330", "method": "POST", "mode": "block", "severity": 9.8, "slug": "geo-my-wp", "target": "plugin", "versions": "<4.5.0.2"}, "RULE-CVE-2024-6365-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"name": "ARGS:settings[order]", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings[order] written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6365-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings phrase parameters written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6366-02": {"ajax_action": "query-attachments", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-6366", "method": "POST", "mode": "block", "severity": 9.1, "slug": "profile-builder", "target": "plugin", "versions": "<=3.11.7"}, "RULE-CVE-2024-6451-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~\\\\.(?:php|php[0-9]+|phtml)\\\\b~i"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6451-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~^(?![^\\\\n]*\\\\.log$)[^\\\\n]+$~"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6455-01": {"ajax_action": "ekit_widgetarea_content", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6455", "description": "ElementsKit Lite <=3.2.0 unauthenticated information exposure via ekit_widgetarea_content AJAX action exposing drafts, pending and private posts", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2024-6460-01": {"ajax_action": "tm_load_data", "conditions": [{"name": "ARGS:component", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|(?:php|data|expect|phar|zip)://)~i"}], "cve": "CVE-2024-6460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6460", "description": "Grow by Tradedoubler <=2.0.21 unauthenticated Local File Inclusion via tm_load_data AJAX component parameter", "mode": "block", "severity": 9.8, "slug": "tradedoubler-affiliate-tracker", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.0.21"}, "RULE-CVE-2024-6500-01": {"action": "parse_request", "conditions": [{"name": "ARGS:easypack_download", "type": "regex", "value": "~(\\\\.\\\\.(?:[/\\\\\\\\]|%2f|%5c)|%2e(?:%2e|\\\\.(?:%2f|%5c|[/\\\\\\\\]))|%2e%2e(?:%2f|/|%5c|\\\\\\\\)|^/|^[A-Za-z]:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6500", "description": "InPost for WooCommerce <=1.4.4 unauthenticated arbitrary file read/delete via easypack_download query var", "mode": "block", "severity": 10.0, "slug": "inpost-for-woocommerce", "tags": ["missing-authorization", "path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-6522-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"name": "ARGS:name", "type": "exists"}, {"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6522", "description": "Modern Events Calendar Lite <=7.12.1 authenticated (subscriber+) SSRF via mec_fes_form AJAX action", "method": "POST", "mode": "block", "severity": 9.6, "slug": "modern-events-calendar-lite", "tags": ["ssrf", "server-side-request-forgery", "authenticated", "cwe-918"], "target": "plugin", "versions": "<=7.12.1"}, "RULE-CVE-2024-6589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6624-01": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-01G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6660-01": {"ajax_action": "bookingpress_import_data_continue_process_func", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6660", "description": "BookingPress <=1.1.5 missing authorization on bookingpress_import_data_continue_process_func allows subscriber+ arbitrary options update and file upload", "mode": "block", "severity": 8.8, "slug": "bookingpress-appointment-booking", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2024-6691-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php$~"}, {"name": "ARGS:option_page", "type": "equals", "value": "edd_settings"}], "cve": "CVE-2024-6691", "method": "POST", "mode": "block", "severity": 4.0, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:edd_settings[agree_text]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-6692", "method": "POST", "mode": "block", "severity": 3.1, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6704-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-02": {"ajax_action": "wpdAddInlineComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddInlineComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-03": {"ajax_action": "wpdGuestAction", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via guest comment submission", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6723-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6809-01": {"ajax_action": "qcsmd_upvote_action", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-6809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6809", "description": "Simple Video Directory <=1.4.2 unauthenticated SQL injection via id parameter in qcsmd_upvote_action AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "simple-media-directory", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-6849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (async-upload.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/media-new\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (media-new.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (REST /wp/v2/media)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-7031-01": {"ajax_action": "njt_fs_save_setting_restrictions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7031-02": {"ajax_action": "njt_fs_save_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7094-01": {"action": "init", "conditions": [{"name": "ARGS:form_request", "type": "equals", "value": "jssupportticket"}, {"name": "ARGS:jstmod", "type": "equals", "value": "themes"}, {"name": "ARGS:task", "type": "equals", "value": "savetheme"}, {"name": "ARGS:/color[1-7]/", "type": "regex", "value": "~[\\"\'`;]|<\\\\?(?:php|=)|[$][a-zA-Z_]~"}], "cve": "CVE-2024-7094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7094", "description": "JS Help Desk <=2.8.6 unauthorized frontend savetheme dispatch via formhandler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "js-support-ticket", "tags": ["missing-authorization", "code-injection", "frontend-form"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-7122-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7122-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor REST save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7257-01": {"ajax_action": "yaye_handle_upload_file", "conditions": [{"name": "FILES:option_field_data", "type": "exists"}], "cve": "CVE-2024-7257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7257", "description": "YayExtra \\u2013 WooCommerce Extra Product Options <=1.3.7 unauthenticated arbitrary file upload via yaye_handle_upload_file AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yayextra", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2024-7258-01": {"ajax_action": "myajax-delete-feed-file", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed file deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7258-02": {"ajax_action": "myajax-delete-feed", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7302-01": {"ajax_action": "b2s_upload_video", "conditions": [{"name": "ARGS:post_title", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouse(?:down|up|over|out|move)|key(?:down|up|press)|focus|blur|change|submit|reset|select|abort|dragstart|drag|dragend|drop)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-7302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7302", "description": "Blog2Social <=7.5.4 stored XSS via post_title in video upload", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=7.5.4"}, "RULE-CVE-2024-7315-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/[^/]+\\\\.(?:zip|sql|gz|tar|json|txt|log)(?:\\\\?|$)~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7315-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/wpvivid_log/~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7385-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wshs_saved"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 authenticated (Admin+) SQL injection via id parameter in wshs_saved delete action", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7385-02": {"ajax_action": "wshs_save_shortcode", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 SQL injection via id parameter in wshs_save_shortcode AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7493-01": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:role", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via role parameter in registration", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-02": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_capabilities", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-03": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_user_level", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7514-01": {"ajax_action": "product_comments_csv_import_request", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2[Ee]){2}%2[Ff]|(?:%252[Ee]){2}%25(?:2[Ff]|5[Cc])|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-7514", "description": "Comments Import & Export <=2.3.7 authenticated arbitrary file read via path traversal in file parameter", "mode": "block", "severity": 6.5, "slug": "comments-import-export-woocommerce", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-7548-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7590-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7590-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7607-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "feup-users"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7607", "description": "Front End Only Users <=3.2.28 authenticated SQL injection via order parameter on feup-users admin page", "mode": "block", "severity": 8.8, "slug": "front-end-only-users", "target": "plugin", "versions": "<=3.2.28"}, "RULE-CVE-2024-7656-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|"|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via devvn_ihotspot shortcode unserialize sink \\u2014 write-time block on content param", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7656-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|"|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via post_content carrying devvn_ihotspot serialized object", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7703-01": {"ajax_action": "arm_upload_front", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_front", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-02": {"ajax_action": "arm_upload_cover", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_cover", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-03": {"ajax_action": "arm_upload_profile", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_profile", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-04": {"ajax_action": "arm_import_user", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file import in arm_import_user", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7770-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~file-manager/libs/elFinder/php/connector~i"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2024-7770", "description": "Bit File Manager <=6.5.5 block direct access to elFinder connector with dangerous file upload", "mode": "block", "severity": 8.8, "slug": "file-manager", "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2024-7856-01": {"ajax_action": "removeTempFiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7856", "description": "MP3 Music Player by Sonaar <=5.7.0.1 missing authorization (subscriber+) arbitrary file deletion via removeTempFiles AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mp3-music-player-by-sonaar", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=5.7.0.1"}, "RULE-CVE-2024-7857-01": {"ajax_action": "mlf_change_sort_type", "conditions": [{"name": "ARGS:sort_type", "type": "detectSQLi"}], "cve": "CVE-2024-7857", "method": "POST", "mode": "block", "severity": 6.5, "slug": "media-library-plus", "target": "plugin", "versions": "<=8.2.2"}, "RULE-CVE-2024-7982-01": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:first_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via first_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7982-02": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:last_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via last_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7985-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess)$~i"}], "cve": "CVE-2024-7985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7985", "description": "File Organizer <=1.0.9 authenticated arbitrary file upload via filename extension bypass", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["arbitrary-file-upload", "authenticated", "file-upload"], "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2024-8252-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in post content (post.php)", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8252-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in REST API post creation", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8271-01": {"ajax_action": "woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (custom_prices parameter flows to do_shortcode at classes/woocs.php:4600)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8271-02": {"ajax_action": "nopriv_woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (nopriv hook)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8275-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|EXTRACTVALUE\\\\s*\\\\(|CONCAT\\\\s*\\\\(|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-8275", "description": "The Events Calendar <=6.6.4 unauthenticated SQL injection via order parameter in tribe_has_next_event template tag", "method": "GET", "mode": "block", "severity": 9.8, "slug": "the-events-calendar", "target": "plugin", "versions": "<=6.6.4"}, "RULE-CVE-2024-8289-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/?(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PUT", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PATCH", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_users"}], "cve": "CVE-2024-8289", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/batch(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8353-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address_2", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_city", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_state", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_zip", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_name", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_number", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-09": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_cvc", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-10": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_month", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-11": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_year", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-12": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:billing_country", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-13": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-14": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-15": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8485-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/watch-life-net/v1/weixin/updateuserinfo(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-8485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8485", "description": "REST API TO MiniProgram <=4.7.1 unauthenticated arbitrary user email update and privilege escalation via updateuserinfo REST endpoint IDOR", "method": "POST", "mode": "block", "severity": 9.8, "slug": "rest-api-to-miniprogram", "tags": ["authorization-bypass", "idor", "privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.7.6"}, "RULE-CVE-2024-8500-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS via su_generator_preview shortcode/atts/content parameters reaching echo sink in Su_Generator::preview", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8500-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS/code-flow via su_generator_settings shortcode parameter reaching echo/call_user_func sinks", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8519-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "um_loggedin"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|toggle|begin|end)\\\\s*=|javascript\\\\s*:|<\\\\s*iframe[\\\\s>]|<\\\\s*svg[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-8519", "description": "Ultimate Member <=2.8.6 stored XSS via um_loggedin shortcode lock_text attribute or inner content", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-8522-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/learnpress/v1/courses~"}, {"name": "ARGS:c_only_fields", "type": "regex", "value": "~(?i)(SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\(SELECT\\\\b|UNION\\\\s+SELECT\\\\b)~"}], "cve": "CVE-2024-8522", "description": "LearnPress <=4.2.7 unauthenticated SQL injection via c_only_fields parameter in REST courses endpoint.", "method": "GET", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.1"}, "RULE-CVE-2024-8800-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(%3Cscript|]*onerror\\\\s*=|<[^>]*onload\\\\s*=|<[^>]*onclick\\\\s*=|\\\\bonerror\\\\s*=|\\\\bonload\\\\s*=|\\\\bonclick\\\\s*=|%22%3E|%27%3E)~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8800-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)%3cscript|]*onerror\\\\s*=|]*href\\\\s*=\\\\s*[\'\\"]javascript:~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8853-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:user_login", "type": "contains", "value": "-wfuser"}], "cve": "CVE-2024-8853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8853", "description": "Webo-facto <=1.40 unauthenticated privilege escalation via user_login containing -wfuser substring", "method": "POST", "mode": "block", "severity": 9.8, "slug": "webo-facto-connector", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.40"}, "RULE-CVE-2024-8978-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(\\\\{\\\\{password\\\\}\\\\}|%7B%7Bpassword%7D%7D)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-8978", "method": "POST", "mode": "block", "severity": 5.7, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-8979-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|eael_get_token|save_settings_with_ajax|save_eael_elements_data)$~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[user_password\\\\]~i"}], "cve": "CVE-2024-8979", "description": "Essential Addons for Elementor Lite <=6.0.9 sensitive information disclosure via [user_password] placeholder in lostpassword email template (Login_Register widget)", "mode": "block", "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-9061-01": {"ajax_action": "shortcode_Api_Add", "conditions": [{"name": "ARGS:custom-popup", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9061", "description": "WP Popup Builder <=1.3.5 unauthenticated arbitrary shortcode execution via custom-popup parameter", "mode": "block", "severity": 9.8, "slug": "wp-popup-builder", "target": "plugin", "versions": "<=1.3.5"}, "RULE-CVE-2024-9263-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timetics/v1/customers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9263", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9263", "description": "WP Timetics <=1.0.25 unauthenticated account takeover via IDOR on REST customers endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "timetics", "tags": ["idor", "account-takeover", "unauthenticated", "rest-api", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.25"}, "RULE-CVE-2024-9390-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "modula-gallery"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via FancyBox attributes in gallery CPT settings", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9416-02": {"ajax_action": "add_images_to_gallery", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via add_images_to_gallery AJAX handler", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu-social-login/type/[^/]+(/|\\\\?|$)~"}, {"name": "ARGS:code", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9501", "description": "Wp Social Login and Register Social Counter <=3.0.7 authentication bypass via social login OAuth callback REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-social", "tags": ["authentication-bypass", "unauthenticated", "rest-api", "oauth"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2024-9504-01": {"ajax_action": "wpdevart_form_ajax", "conditions": [{"name": "FILES:file0", "type": "exists"}], "cve": "CVE-2024-9504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9504", "description": "Booking Calendar <=3.2.15 unauthenticated stored XSS via SVG file upload in wpdevart_form_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "booking-calendar", "tags": ["xss", "svg-upload", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2024-9598-01": {"ajax_action": "redux_p", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9598", "description": "AMP for WP CSRF via missing nonce validation on redux_p AJAX proxy endpoint", "mode": "block", "severity": 8.8, "slug": "accelerated-mobile-pages", "target": "plugin", "versions": "<=1.0.99.1"}, "RULE-CVE-2024-9634-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9634-02": {"action": "init", "conditions": [{"name": "ARGS:give_action", "type": "equals", "value": "purchase"}, {"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9636-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9636-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9655-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v[12]/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in REST API post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9655-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in classic editor post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9669-01": {"ajax_action": "njt_fs_save_setting", "conditions": [{"name": "ARGS:fm_locale", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.|%2e%2e[%2f%5c]|%252e%252e|%00)~i"}], "cve": "CVE-2024-9669", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9669", "description": "Filester <=1.8.5 local file inclusion via fm_locale path traversal in njt_fs_save_setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "filester", "tags": ["local-file-inclusion", "path-traversal"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2024-9707-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/ai-site-import(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9707", "method": "POST", "mode": "block", "severity": 9.8, "slug": "hunk-companion", "target": "plugin", "versions": "<=1.8.4"}, "RULE-CVE-2024-9769-01": {"ajax_action": "tsvg_check_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9769-02": {"ajax_action": "tsvg_get_attachment_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9881-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:learn_press_offline_payment[description]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9881", "method": "POST", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.2"}, "RULE-CVE-2024-9935-01": {"action": "init", "conditions": [{"name": "ARGS:rtw_pdf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2024-9935", "description": "PDF Generator Addon for Elementor Page Builder <=2.0.0 local file inclusion via rtw_pdf_file parameter", "mode": "block", "severity": 7.5, "slug": "pdf-generator-addon-for-elementor-page-builder", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2024-9993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_event_details_text"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_event_details_text in Event Calendar widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9994-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<(?:script|img|svg|iframe|details|video|audio|source)[\\\\s/>]|on(?:error|load|toggle|click|mouse\\\\w+|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9994", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2025-0215-01": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:uri", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via uri parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-02": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:initiate_restore", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via initiate_restore parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-03": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:showdata", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via showdata parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0308-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|SL(?:/\\\\*[^*]*\\\\*/)?EEP\\\\s*\\\\()~i"}, {"name": "ARGS:search", "type": "regex", "value": "~(?i)(\\\\b(sleep|benchmark|union|select|if)\\\\b|--|/\\\\*|#|;)~i"}], "cve": "CVE-2025-0308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0308", "description": "Ultimate Member <=2.9.1 unauthenticated SQL injection via search parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2025-0311-01": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL (javascript:/data: URI injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-02": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-03": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-04": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0350-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wdcl_image_carousel_child\\\\b[^\\\\]]*(?:][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (REST API post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "rise-blocks/site-identity"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"(?:titleTag|taglineTag)\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*[<>][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (classic post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0507-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|�*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0512-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\s[^\\\\]]*(?:]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|�*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/trx_addons/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+|(?:php|data|expect|phar|zip|compress\\\\.zlib|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal and PHP wrapper abuse in REST API. Blocks directory traversal (../../) and PHP stream wrappers (php://, phar://, etc.) in any parameter sent to /wp-json/trx_addons/ endpoints. Covers CVE-2020-10257 RCE vector and CVE-2025-0682 shortcode LFI when accessed via REST.", "mode": "block", "severity": 8.8, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "rest-api", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-02": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?!(?:fonts|images|css|js|assets|vendor|dist|lib|node_modules|wp-content|wp-includes|uploads|components|templates|shortcodes)[\\\\/])|(?:php|phar|expect|zip|compress\\\\.zlib|data|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal in template selector parameters (type, layout, template, view, skin) across all entry points \\u2014 AJAX, shortcodes, REST, front-end template loaders. Fires on init hook for maximum coverage. Covers 190+ theme-level LFI CVEs from AncoraThemes, axiomthemes, ThemeREX.", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "shortcode", "ajax", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-03": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log|(?:id_[rd]sa|authorized_keys))~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 defense-in-depth: block known sensitive file names in template selector parameters. Catches absolute path inclusion attempts without directory traversal (e.g., type=wp-config.php).", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "sensitive-file", "defense-in-depth", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0764-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-07": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] path traversal in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-08": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-09": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0804-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^clickwhale~"}, {"name": "ARGS:title", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0804", "description": "ClickWhale <=2.4.1 Stored XSS via link title on admin page", "method": "POST", "mode": "block", "severity": 5.4, "slug": "clickwhale", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mlcalc\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment body logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0916-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment author name logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0918-01": {"ajax_action": "_email_logs", "conditions": [{"name": "ARGS:params[valSearch]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log list (action=_email_logs); blocks HTML/script payload in params[valSearch]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0918-02": {"ajax_action": "_detail_email_logs", "conditions": [{"name": "ARGS:params[id]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log detail (action=_detail_email_logs); blocks HTML/script payload in params[id]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0924-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:log", "type": "detectXSS"}], "cve": "CVE-2025-0924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0924", "description": "WP Activity Log <=5.2.2 unauthenticated stored XSS via username field on login form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-security-audit-log", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2025-0953-01": {"ajax_action": "_detail_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log detail", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0953-02": {"ajax_action": "_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log list", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0957-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email logs list AJAX - attacker-controlled email content may be rendered in logs; block XSS markers in search parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0957-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_detail_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email log detail AJAX - attacker-controlled email content may be rendered in log detail; block XSS markers in selector parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0968-01": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0968-02": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0969-01": {"ajax_action": "brizy_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0969", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0969", "description": "Brizy Page Builder <=2.7.16 authenticated sensitive information exposure via brizy_get_users AJAX action", "mode": "block", "severity": 6.5, "slug": "brizy", "tags": ["missing-authorization", "sensitive-information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=2.7.16"}, "RULE-CVE-2025-10000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~data:[^;]*(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|aspx?|jsp|jspx?|cfm|phtml|user\\\\.ini|htaccess|htpasswd)[^;]*;base64~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:format", "type": "regex", "value": "~^(?:\\\\.)?(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint - format parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10002-01": {"ajax_action": "clickwhale/admin/export_csv", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10002", "description": "ClickWhale <=2.5.0 authenticated SQL injection via id parameter in export_csv AJAX handler", "mode": "block", "severity": 4.9, "slug": "clickwhale", "tags": ["sql-injection", "authenticated", "csv-export"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-10036-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10039-01": {"ajax_action": "eh_crm_ticket_single_view_client", "conditions": [{"name": "ARGS:ticket_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10039", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.2.9 IDOR via eh_crm_ticket_single_view_client allows Subscriber+ to read any ticket", "method": "POST", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["idor", "missing-authorization", "insecure-direct-object-reference", "information-disclosure"], "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2025-10045-01": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via order parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10045-02": {"action": "admin_init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via orderby parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10046-01": {"ajax_action": "elex_gpf_manage_feed_remove_file", "conditions": [{"name": "ARGS:file_to_delete", "type": "detectSQLi"}], "cve": "CVE-2025-10046", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10046", "description": "ELEX WooCommerce Google Shopping <=1.4.3 authenticated SQL injection via file_to_delete in feed removal AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elex-woocommerce-google-product-feed-plugin-basic", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-10047-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-tracker"}, {"name": "ARGS:orderby", "type": "regex", "value": "~[(),\'\\"`]|\\\\bselect\\\\b|\\\\bcase\\\\b|\\\\bwhen\\\\b|\\\\bsleep\\\\b|\\\\bunion\\\\b|--\\\\s|/\\\\*~i"}], "cve": "CVE-2025-10047", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10047", "description": "Email Tracker <=5.3.15 authenticated (Admin+) SQL injection via orderby parameter in email list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-tracker", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=5.3.15"}, "RULE-CVE-2025-10048-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via order parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10048-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via orderby parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10049-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:HdnMediaSelection", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|cgi|asp|aspx|jsp|jspx|cfm|shtml)(?:\\\\?|%3[Ff]|%00|$)~i"}], "cve": "CVE-2025-10049", "method": "POST", "mode": "block", "severity": 7.2, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.24"}, "RULE-CVE-2025-1005-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-1005-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget in post content save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-10054-01": {"ajax_action": "eh_crm_remove_agent", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10054", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.1 missing authorization on eh_crm_remove_agent AJAX action allows Subscriber+ role removal", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "role-removal"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-10055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:ProjectName", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via ProjectName on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-queue-invoice"}, {"name": "ARGS:timesheet_id", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via timesheet_id on queue-invoice page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-my-dashboard"}, {"name": "ARGS:team_member", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via team_member on my-dashboard page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:notes", "type": "regex", "value": "~]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via notes on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10058-01": {"ajax_action": "get_ftp_url", "conditions": [{"name": "ARGS:HostPath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10058", "description": "WP Ultimate CSV Importer <=7.27 authenticated arbitrary file deletion via get_ftp_url AJAX action (HostPath path traversal)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wp-ultimate-csv-importer", "tags": ["arbitrary-file-deletion", "path-traversal", "missing-authorization"], "target": "plugin", "versions": "<=7.27"}, "RULE-CVE-2025-10124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[booking-manager-delete\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10124", "description": "Booking Manager <=2.1.14 unauthorized booking deletion via [booking-manager-delete] shortcode injection in Classic Editor post save", "method": "POST", "mode": "block", "severity": 4.5, "slug": "booking-manager", "tags": ["incorrect-authorization", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-10125-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with script/tag injection (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with javascript: URI (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute event handler injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute script/tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute javascript: URI (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10136-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis[\\\\s\\\\S]*?(?:]*onerror|]*onerror|]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10167-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "[alg_wc_stock_snapshot_restocked"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[alg_wc_stock_snapshot_restocked\\\\s[^\\\\]]*(?:]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10181-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[drafts\\\\b[^\\\\]]*template\\\\s*=\\\\s*(?:([\'\\"])(?:(?!\\\\1).)*(?:]*\\\\son[a-zA-Z0-9_]+\\\\s*=|[\'\\"]\\\\s*on[a-zA-Z0-9_]+\\\\s*=|expression\\\\s*\\\\()~i"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via return URL parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via coupon parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:email", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via email parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:paypal", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via paypal parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-07": {"action": "init", "conditions": [{"name": "ARGS:paypal_form_coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 reflected XSS via paypal_form_coupon shortcode parameter (unauthenticated)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "reflected-xss", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10310-01": {"ajax_action": "easysnippetGet", "conditions": [{"name": "ARGS:last", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}, {"name": "ARGS:last", "type": "regex", "value": "~(?i)(?:(?:[\'\\\\\\"]\\\\s*)?\\\\b(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER\\\\s+BY|GROUP\\\\s+BY|SLEEP|BENCHMARK|WAITFOR|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\b|(?:--\\\\s*$)|(?:/\\\\*)|(?:;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)))~"}], "cve": "CVE-2025-10310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10310", "description": "Rich Snippet Site Report <=2.0.0105 authenticated SQL injection via last parameter in easysnippetGet AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easysnippet", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.0.0105"}, "RULE-CVE-2025-10376-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "crfl_redirect_setting"}, {"name": "ARGS:id", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-10376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10376", "description": "Course Redirects for Learndash <=0.4 CSRF to reflected XSS via unsanitized id parameter on settings page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "course-redirects-for-learndash", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=0.4"}, "RULE-CVE-2025-10380-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on REST API save endpoint - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining with dangerous PHP callables on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on post.php save - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-1043-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in post_content stored through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-1043-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in content stored through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-10476-01": {"ajax_action": "wpfc_db_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10476", "mode": "block", "severity": 4.3, "slug": "wp-fastest-cache", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10487-01": {"ajax_action": "advads_ad_select", "conditions": [{"name": "ARGS:ad_method", "type": "regex", "value": "~^(?!ad$|group$|placement$|id$).+~"}], "cve": "CVE-2025-10487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10487", "description": "Advanced Ads <=2.0.12 unauthenticated limited RCE via ad_method parameter in advads_ad_select AJAX handler", "mode": "block", "severity": 7.3, "slug": "advanced-ads", "tags": ["code-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=2.0.12"}, "RULE-CVE-2025-1054-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~uicore-(?:counter|icon-box|testimonial-(?:slider|grid|carousel))~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]*>|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:[^\\\\s]|]*\\\\bon\\\\w+\\\\s*=|]*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1054", "description": "UiCore Elements <=1.0.16 Stored XSS via Counter/Icon Box/Testimonial widgets on REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uicore-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.16"}, "RULE-CVE-2025-10567-01": {"ajax_action": "get_gutenberg_checkout_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(script|img|svg|iframe|details|embed|object|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|meta|link|style|base|source|applet)[\\\\s/>]|\\\\bon(error|load|click|mouse\\\\w+|focus|blur|toggle|resize|submit|change|input|key\\\\w+|touch\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-10567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10567", "description": "FunnelKit <=3.12.0 reflected XSS via unsanitized checkout text fields in get_gutenberg_checkout_from_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.3, "slug": "funnel-builder", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.12.0"}, "RULE-CVE-2025-10570-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10570", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10570", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.38 missing authorization on fr_refund_request AJAX action allows subscriber+ IDOR refund requests", "method": "POST", "mode": "block", "severity": 4.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.38"}, "RULE-CVE-2025-10579-01": {"ajax_action": "backwpup_working", "conditions": [{"name": "ARGS:jobid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "backwpup"}], "cve": "CVE-2025-10579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10579", "description": "BackWPup <=5.5.0 missing authorization on backwpup_working AJAX action exposes backup filename to low-privilege users", "mode": "block", "severity": 5.3, "slug": "backwpup", "tags": ["missing-authorization", "information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2025-10580-01": {"ajax_action": "widgetopts_ajax_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<[^>]*\\\\bon\\\\w+\\\\s*=|<\\\\s*(?:script|img|svg|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_ajax_settings widget option save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10580-02": {"ajax_action": "widgetopts_migrator", "conditions": [{"name": "ARGS:single_sidebar", "type": "detectXSS"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_migrator single_sidebar parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10587-01": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_category", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-10587-02": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_venue", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-1063-01": {"ajax_action": "rtcl_taxonomy_settings_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1063", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1063", "description": "Classified Listing <=4.0.4 unauthenticated settings exposure via rtcl_taxonomy_settings_export AJAX action", "mode": "block", "severity": 5.3, "slug": "classified-listing", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1064-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (javascript:/data: URI injection in href)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-1064-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (Gutenberg REST API content field)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-10645-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-reset[/\\\\\\\\](?:.*/)?wf-licensing\\\\.log([?#]|$)~i"}], "cve": "CVE-2025-10645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10645", "description": "WP Reset <=2.05 unauthenticated sensitive information exposure via wf-licensing.log direct file access", "method": "GET", "mode": "block", "severity": 5.3, "slug": "wp-reset", "tags": ["information-disclosure", "sensitive-log-file", "unauthenticated"], "target": "plugin", "versions": "<=2.05"}, "RULE-CVE-2025-10647-01": {"ajax_action": "epdf_wf_download_pdf_media", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.|%2e)(?:ph(?:p\\\\d*|ar|ps|t|tml?)|phtml)(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-10647", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10647", "description": "Embed PDF for WPForms <=1.1.5 arbitrary file upload via dangerous file extension in url parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "embed-pdf-wpforms", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-10649-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^usces_(?:orderlist|memberlist|itemedit)$~"}, {"name": "REQUEST_COOKIES:usces_cookie", "type": "regex", "value": "~(?:sortColumn|sortSwitchs)[^;]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|ORDER\\\\s+BY|AND\\\\s+|OR\\\\s+[\\\\d\\"\\\\\']|[\\\\\'\\\\\\"]\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10649", "description": "Welcart e-Commerce <=2.11.21 authenticated (Author+) SQL injection via usces_cookie sortColumn/sortSwitchs in admin list pages", "method": "GET", "mode": "block", "severity": 6.5, "slug": "usc-e-shop", "tags": ["sql-injection", "cookie-injection", "authenticated"], "target": "plugin", "versions": "<=2.11.21"}, "RULE-CVE-2025-1065-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via type parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:library", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via library parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:date", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via date parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:source", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via source parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via s (search) parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via orderby parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via order parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-10660-01": {"ajax_action": "dashboard_chat", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10660", "description": "WP Dashboard Chat <=1.0.3 authenticated SQL injection via id parameter in dashboard_chat AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-dashboard-chat", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10682-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tariffuxx_configurator[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|EXEC|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+OUTFILE|INTO\\\\s+DUMPFILE)\\\\b|--|#|/\\\\*|\'\\\\s*(?:OR|AND)(?:\\\\s|[\'\\"(]))~i"}], "cve": "CVE-2025-10682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10682", "description": "TARIFFUXX <=1.4 SQL injection via tariffuxx_configurator shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "tariffuxx", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10683-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10683-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10686-01": {"ajax_action": "cretats_get_preview_html", "conditions": [{"name": "ARGS:cretats_layout", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2025-10686", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10686", "description": "Creta Testimonial Showcase <=1.2.3 authenticated Local File Inclusion via cretats_layout parameter in cretats_get_preview_html AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "creta-testimonial-showcase", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-10745-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]banhammer-process_~"}], "cve": "CVE-2025-10745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10745", "description": "Banhammer <=3.4.8 unauthenticated protection mechanism bypass via predictable banhammer-process_ GET parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "banhammer", "tags": ["protection-bypass", "predictable-secret", "unauthenticated"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-10748-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "rapidresult"}, {"name": "ARGS:s", "type": "regex", "value": "~\'\\\\s*(?:(?:OR|AND)\\\\s+[^\']{0,40}(?:--|#|/[*])|(?:OR|AND)\\\\s+[0-9]+\\\\s*[=<>]|(?:OR|AND)\\\\s*[(]\\\\s*SELECT\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)|SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]~i"}], "cve": "CVE-2025-10748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10748", "description": "RapidResult <=1.2 authenticated (Contributor+) SQL injection via s parameter in admin search", "method": "GET", "mode": "block", "severity": 6.5, "slug": "rapidresult", "tags": ["sql-injection", "authenticated", "admin-search"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10749-01": {"ajax_action": "azure-storage-media-replace", "conditions": [{"name": "ARGS:replace_attachment", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-10749", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10749", "description": "Microsoft Azure Storage for WordPress <=4.5.1 missing authorization on azure-storage-media-replace AJAX action allows authenticated subscribers to delete arbitrary media", "method": "POST", "mode": "block", "severity": 5.4, "slug": "windows-azure-storage", "tags": ["missing-authorization", "broken-access-control", "arbitrary-media-deletion"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-10754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "docodoco-store-locator"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10754", "description": "DocoDoco Store Locator <=1.0.1 authenticated (Editor+) arbitrary file upload via ZIP import", "method": "POST", "mode": "block", "severity": 7.2, "slug": "docodoco-store-locator", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-10862-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via id parameter on PUT /popup/logs REST endpoint", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10862-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:campaignId", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via campaignId parameter on GET /popup/logs REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10873-02": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_email", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_email parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10873-03": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_name", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_name parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10874-01": {"ajax_action": "handle-request-mystock", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://([a-z0-9-]+\\\\.)*static\\\\.?flickr\\\\.com(/|$)).+~i"}], "cve": "CVE-2025-10874", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10874", "description": "Orbit Fox by ThemeIsle <=3.0.1 authenticated SSRF via MyStock image import (handle-request-mystock)", "method": "POST", "mode": "block", "severity": 5.5, "slug": "themeisle-companion", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-10902-01": {"ajax_action": "origaich_ai_scan_result_remove", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10902", "description": "Originality.ai AI Checker <=1.0.15 missing authorization on scan log deletion via origaich_ai_scan_result_remove AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "originality-ai", "tags": ["missing-authorization", "broken-access-control", "data-deletion"], "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2025-10916-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/responses/attachments(?:/|\\\\?|&|$)~"}, {"name": "ARGS:file_token", "type": "regex", "value": "~(?:Li4v|Li5c)~"}], "cve": "CVE-2025-10916", "method": "DELETE", "mode": "block", "severity": 9.1, "slug": "formgent", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-11003-01": {"ajax_action": "uip_save_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_save_ui_template AJAX handler allows Subscriber+ Stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11003-02": {"ajax_action": "uip_create_new_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_create_new_ui_template AJAX handler allows Subscriber+ template creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11007-01": {"ajax_action": "ce21_single_sign_on_save_api_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ce21-suite", "target": "plugin", "versions": ">=2.2.1 <=2.3.1"}, "RULE-CVE-2025-11128-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/feedzy/v1/feed(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~https?://(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?)~i"}], "cve": "CVE-2025-11128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11128", "description": "Feedzy RSS Feeds Lite <=5.1.0 authenticated SSRF via REST API url parameter targeting internal/private IPs", "method": "POST", "mode": "block", "severity": 5.0, "slug": "feedzy-rss-feeds", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2025-11162-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~]*>|]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in REST API post meta", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11162-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~]*>|]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "classic-editor", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11171-01": {"ajax_action": "ays_chart_admin_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_admin_ajax AJAX handler allowing unauthenticated admin method dispatch", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-02": {"ajax_action": "ays_chart_install_plugin", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_install_plugin AJAX handler allowing unauthenticated plugin installation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-03": {"ajax_action": "ays_chart_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_activate_plugin AJAX handler allowing unauthenticated plugin activation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-05": {"ajax_action": "ays_chart_dismiss_button", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_dismiss_button AJAX handler allowing unauthenticated notice dismissal", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11174-01": {"ajax_action": "dll_load_posts", "conditions": [{"name": "ARGS:args[status]", "type": "regex", "value": "~^(?:draft|pending|future|private|any)$~i"}], "cve": "CVE-2025-11174", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11174", "description": "Document Library Lite <=1.1.6 unauthenticated sensitive information exposure via dll_load_posts AJAX handler args[status] parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "document-library-lite", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-11185-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cmplz-accept-link\\\\b[^\\\\]]*(?:on[a-z]+=|]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=~i"}], "cve": "CVE-2025-1123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1123", "description": "Solid Mail (WP SMTP) <=2.1.5 stored XSS via test email fields in solidwp_mail_send_test_email AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-smtp", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2025-11254-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via gallery form upload submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11254-03": {"ajax_action": "post_cg_registry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via registry submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11256-01": {"action": "admin_post_nopriv_delete_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file deletion via admin_post_nopriv_delete_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-02": {"action": "admin_post_nopriv_delete_all_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk log deletion via admin_post_nopriv_delete_all_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-03": {"action": "admin_post_nopriv_download_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file download via admin_post_nopriv_download_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-04": {"action": "admin_post_nopriv_fix_permissions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated permission fix via admin_post_nopriv_fix_permissions", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-05": {"action": "admin_post_nopriv_download_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log download via admin_post_nopriv_download_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-06": {"action": "admin_post_nopriv_delete_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log deletion via admin_post_nopriv_delete_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-07": {"action": "admin_post_nopriv_delete_all_widget_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk widget log deletion via admin_post_nopriv_delete_all_widget_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-09": {"ajax_action": "chatbot_chatgpt_upload_files", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated limited file upload via chatbot_chatgpt_upload_files AJAX", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11262-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper/ai-auth(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_id", "type": "regex", "value": "~<\\\\s{0,8}/?\\\\s{0,8}[a-z]|%3c\\\\s{0,8}(?:%2f)?\\\\s{0,8}[a-z]|\\\\bon\\\\w{1,24}\\\\s{0,8}=|javascript\\\\s{0,8}:~i"}], "cve": "CVE-2025-11262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11262", "description": "Link Whisper Free <=0.9.0 unauthenticated stored XSS via the user_id parameter of the ai-auth REST endpoint (POST /wp-json/link-whisper/ai-auth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "link-whisper", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.9.0"}, "RULE-CVE-2025-11271-01": {"action": "init", "conditions": [{"name": "ARGS:verification_override", "type": "exists"}], "cve": "CVE-2025-11271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11271", "description": "Easy Digital Downloads <=3.5.2 PayPal IPN verification bypass via verification_override parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "tags": ["verification-bypass", "unauthenticated", "payment-fraud", "cwe-807"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-11307-01": {"ajax_action": "wpgmza_rest_api_request", "conditions": [{"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via wpgmza_rest_api_request AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11307-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpgmza/v1/~"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via REST API /wpgmza/v1/ endpoints", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11361-01": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~(?:^|[/\\\\\\\\@])(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|localhost|\\\\[::1\\\\])~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - internal/private IP targets", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11361-02": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~^\\\\s*(?:gopher|file|dict|ftp|data|ldap|telnet|tftp|jar|netdoc)\\\\s*:~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - dangerous URL schemes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11369-01": {"ajax_action": "get_instagram_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on get_instagram_access_token AJAX action allows Author+ to read Instagram API token", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-02": {"ajax_action": "google_map_api_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on google_map_api_key AJAX action allows Author+ to read Google Maps API key", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-03": {"ajax_action": "openverse_email_name_DB", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on openverse_email_name_DB AJAX action allows Author+ to read OpenVerse API credentials", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11370-01": {"ajax_action": "depicter-document-rules-store", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule update via depicter-document-rules-store AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11370-02": {"ajax_action": "depicter-document-rules-show", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule read via depicter-document-rules-show AJAX action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11372-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "lp/v1/admin/tools/create-indexs"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11372", "description": "LearnPress \\u2013 WordPress LMS Plugin Admin Tools REST create-indexs endpoint is exposed without authorization because it is registered with permission_callback set to __return_true, allowing unauthenticated destructive database operations (dropping indexes on any table including wp_options, creating duplicate configuration entries, and degrading performance) via /wp-json/lp/v1/admin/tools/create-indexs when table names are supplied.", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "tags": ["missing-authorization", "rest-api", "unauthenticated", "database-manipulation"], "target": "plugin", "versions": "<=4.2.9.3"}, "RULE-CVE-2025-11377-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11377-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute (REST API)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass", "rest-api"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\/wp-content\\\\/webp-express\\\\/config\\\\/.*\\\\.json~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11379", "description": "WebP Express <=0.25.9 unauthenticated information disclosure via predictable config.json file path", "method": "GET", "mode": "block", "severity": 5.3, "slug": "webp-express", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=0.25.9"}, "RULE-CVE-2025-11380-01": {"ajax_action": "everest_process_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_process_status AJAX action leading to unauthenticated backup file location disclosure", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11380-02": {"ajax_action": "everest_backup_process_status_unlink", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_backup_process_status_unlink AJAX action allowing unauthenticated status file deletion", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "data-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11427-01": {"ajax_action": "wpmdb_flush", "conditions": [{"name": "ARGS:download", "type": "regex", "value": "~(?:https?|ftp|file|php|data|phar|compress\\\\.(?:zlib|bzip2)|zip|glob|expect)://~i"}], "cve": "CVE-2025-11427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11427", "description": "WP Migrate Lite <=2.7.6 unauthenticated blind SSRF via wpmdb_flush AJAX download parameter", "method": "POST", "mode": "block", "severity": 5.8, "slug": "wp-migrate-db", "tags": ["ssrf", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2025-11448-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envira-convert/v1/bulk-convert(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11448", "description": "Envira Gallery Lite <=1.11.0 missing authorization on bulk-convert REST endpoint", "method": "POST", "mode": "block", "severity": 4.3, "slug": "envira-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2025-11451-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/aal_ajax_unit_loading(/|\\\\?|&|$)~"}, {"name": "ARGS:data[template_path]", "type": "exists"}], "cve": "CVE-2025-11451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11451", "description": "Auto Amazon Links <=5.4.3 unauthenticated arbitrary file read via template_path in REST API", "mode": "block", "severity": 7.5, "slug": "amazon-auto-links", "target": "plugin", "versions": "<=5.4.3"}, "RULE-CVE-2025-11453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:_inpost_head_script[synth_header_script]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11453", "description": "Header and Footer Scripts <=2.2.2 Stored XSS via _inpost_head_script post meta field by Contributor+ users", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-scripts", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-11454-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "eos_scfm_duplicate_post_as_draft"}, {"name": "ARGS:post", "type": "regex", "value": "~[^0-9]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11454", "description": "Specific Content For Mobile <=0.5.5 authenticated SQL injection via post parameter in eos_scfm_duplicate_post_as_draft admin action", "method": "GET", "mode": "block", "severity": 6.5, "slug": "specific-content-for-mobile", "tags": ["sql-injection", "authenticated", "contributor"], "target": "plugin", "versions": "<=0.5.5"}, "RULE-CVE-2025-11457-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/easycommerce/v1/orders(?:/|[?&]|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-11457", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easycommerce", "target": "plugin", "versions": ">=0.9.0-beta2 <=1.8.2"}, "RULE-CVE-2025-11496-01": {"action": "init", "conditions": [{"name": "ARGS:rtb-name", "type": "detectXSS"}], "cve": "CVE-2025-11496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11496", "description": "Five Star Restaurant Reservations <=2.7.5 unauthenticated stored XSS via rtb-name booking form parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "restaurant-reservations", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-11499-01": {"action": "init", "conditions": [{"name": "ARGS:post_featured_image", "type": "regex", "value": "~https?://[^\\\\s\\"\'<>]+\\\\.(?:ph(?:p\\\\d?|ps|tml?|t|ar)|[aj]sp[x]?|cgi|cfm|exe|bash)(?:[?#]|$)~i"}], "cve": "CVE-2025-11499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tablesome", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-11502-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[saswp_tiny_multiple_faq\\\\b[^\\\\]]*(?:]*autoplay|]*(?:onerror|onload|onsrc)\\\\s*=)~i"}], "cve": "CVE-2025-11502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11502", "description": "Schema & Structured Data for WP & AMP <=1.51 Stored XSS via saswp_tiny_multiple_faq shortcode dangerous HTML elements in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.51"}, "RULE-CVE-2025-11504-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]plugins[/\\\\\\\\]quickcreator[/\\\\\\\\]dupasrala\\\\.txt~i"}], "cve": "CVE-2025-11504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11504", "description": "Quickcreator <=0.1.17 unauthenticated sensitive API key exposure via dupasrala.txt static file", "method": "GET", "mode": "block", "severity": 7.5, "slug": "quickcreator", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "cwe-532"], "target": "plugin", "versions": "<=0.1.17"}, "RULE-CVE-2025-11510-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/v1/fb-wipe-clear-all-data(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11510", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11510", "description": "FileBird <=6.4.9 missing authorization on fb-wipe-clear-all-data REST endpoint allows author+ to reset plugin data", "method": "POST", "mode": "block", "severity": 4.3, "slug": "filebird", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=6.4.9"}, "RULE-CVE-2025-11536-01": {"ajax_action": "import_elementor_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_elementor_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11536-02": {"ajax_action": "import_ep_elementor_bundle_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_ep_elementor_bundle_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11564-01": {"ajax_action": "tutor_handle_api_calls", "conditions": [{"name": "ARGS:payment_type", "type": "equals", "value": "recurring"}], "cve": "CVE-2025-11564", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11564", "description": "Tutor LMS <=3.8.3 unauthenticated payment verification bypass via forged recurring payment webhook", "method": "POST", "mode": "block", "severity": 5.3, "slug": "tutor", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2025-11576-01": {"ajax_action": "newcodebyte_chatbot_send_message", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~^\\\\s*[=+\\\\-@]~"}], "cve": "CVE-2025-11576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11576", "description": "AI Chatbot Free Models <=1.6.5 unauthenticated CSV injection via chat message", "method": "POST", "mode": "block", "severity": 4.3, "slug": "chatbot-ai-free-models", "tags": ["csv-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-11587-01": {"action": "admin_post_cnb_apikey_activate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11587", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11587", "description": "Call Now Button <=1.5.3 missing authorization on API key activation via admin_post_cnb_apikey_activate", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2025-11627-01a": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (message)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01b": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01c": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error_msg", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error_msg)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11632-01": {"ajax_action": "cnb_get_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-02": {"ajax_action": "cnb_request_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_request_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-03": {"ajax_action": "cnb_create_chat_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_create_chat_token AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-04": {"ajax_action": "cnb_get_domain_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_domain_status AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-05": {"ajax_action": "cnb_get_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-06": {"ajax_action": "cnb_get_agency_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_agency_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-07": {"ajax_action": "cnb_upgrade_to_yearly", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_upgrade_to_yearly AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-08": {"ajax_action": "cnb_enable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_enable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-09": {"ajax_action": "cnb_disable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_disable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-10": {"ajax_action": "cnb_get_plans", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_plans AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-11": {"ajax_action": "cnb_time_format", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_time_format AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11691-01": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:ppom_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via ppom_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11691-02": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:productmeta_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via productmeta_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php path traversal", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11692-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php targeting sensitive files", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11703-01": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~<[a-z!/][^>]*>~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - HTML tag injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-02": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - DOM event handler injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-03": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - javascript URI injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11705-01": {"ajax_action": "GOTMLS_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 authenticated arbitrary file read via GOTMLS_scan AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-02": {"ajax_action": "GOTMLS_View_Quarantine", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_View_Quarantine AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-03": {"ajax_action": "GOTMLS_load_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_load_update AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-04": {"ajax_action": "GOTMLS_empty_trash", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_empty_trash AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-05": {"ajax_action": "GOTMLS_whitelist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_whitelist AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-06": {"ajax_action": "GOTMLS_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_fix AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11706-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "aruba-hispeed-cache"}, {"name": "ARGS:dbstatus", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-11706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11706", "description": "Aruba HiSpeed Cache <=3.0.2 reflected cross-site scripting via dbstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "aruba-hispeed-cache", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-01": {"ajax_action": "ahsc_reset_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on plugin settings AJAX endpoints", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-02": {"ajax_action": "ahsc_enable_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_purge AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-03": {"ajax_action": "ahsc_enable_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_cron AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-04": {"ajax_action": "ahsc_debug_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on debug_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-05": {"ajax_action": "ahsc_xmlrpc_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on xmlrpc_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-06": {"ajax_action": "ahsc_cron_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-07": {"ajax_action": "ahsc_cron_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_time AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-08": {"ajax_action": "ahsc_dboptimization", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dboptimization AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-09": {"ajax_action": "ahsc_purge_homepage_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_homepage_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-10": {"ajax_action": "ahsc_purge_archive_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_archive_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-11": {"ajax_action": "ahsc_purge_page_on_new_comment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_page_on_new_comment AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-12": {"ajax_action": "ahsc_static_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on static_cache AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-13": {"ajax_action": "ahsc_lazy_load", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on lazy_load AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-14": {"ajax_action": "ahsc_html_optimizer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on html_optimizer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-15": {"ajax_action": "ahsc_dns_preconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-16": {"ajax_action": "ahsc_dns_preconnect_domain_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect_domain_list AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-17": {"ajax_action": "ahsc_cache_warmer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cache_warmer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-18": {"ajax_action": "ahsc_update_apc_Settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on update_apc_Settings AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-19": {"ajax_action": "ahsc_check_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on check_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-20": {"ajax_action": "ahsc_create_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on create_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-21": {"ajax_action": "ahsc_delete_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on delete_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11726-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to create/update global presets", "method": "POST", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11726-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to delete global presets", "method": "DELETE", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11733-01": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:pre_footnotes", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via pre_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11733-02": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_footnotes", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via post_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11734-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:^/wp-json)(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post|(?:^|&|\\\\?)rest_route=(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post)(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-11734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11734", "description": "Broken Link Checker by AIOSEO <=1.2.5 missing authorization on DELETE /aioseoBrokenLinkChecker/v1/post allows contributor+ to trash arbitrary posts", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "broken-link-checker-seo", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-11745-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[adinserter[^\\\\]]*custom-field\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11745", "description": "Ad Inserter <=2.8.7 Stored XSS via [adinserter custom-field] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-inserter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.7"}, "RULE-CVE-2025-11749-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/messages~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11749-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/sse~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11754-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gdpr/v1/settings(?:/)?(?:\\\\?|$)~"}, {"name": "ARGS:platform", "type": "equals", "value": "wordpress"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11754", "description": "GDPR Cookie Consent <=4.1.2 unauthenticated information disclosure via gdpr/v1/settings REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-11755-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipes(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipes", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipe_fields(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipe_fields", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11758-01": {"ajax_action": "aio_time_clock_lite_admin_js", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11758", "description": "All in One Time Clock Lite <=2.0.3 missing authorization on admin AJAX handler allowing unauthenticated page creation and report download", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aio-time-clock-lite", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-11765-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stock[-_]tools)\\\\b[^\\\\]]*\\\\bimage_width\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y shortcode format attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor shortcode before attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_y\\\\b[^\\\\]]*\\\\bformat\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y format attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor before attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11805-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[skipto\\\\b[^\\\\]]*(?:(?:time|text|class)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bon|]~i"}], "cve": "CVE-2025-11820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11820", "description": "Graphina - Elementor Charts and Graphs <=3.1.8 admin settings Stored XSS via graphina_setting_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-11821-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:post_content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11822-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bootstrap_tab\\\\b[^\\\\]]*(?:name|link|active)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]|]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|change|input|submit|pointerover|mouseenter|dblclick|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11876", "description": "Mailgun Subscriptions <=1.3.1 Stored XSS via mailgun_subscription_form shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mailgun-subscriptions", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-11881-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/myappp-verify(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via myappp-verify REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11881-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/system-info(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via system-info REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11917-01": {"ajax_action": "wpematico_test_feed", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp)://|://(?:localhost|\\\\[?::1\\\\]?|0x[0-9a-f]|0[0-7]{2,}|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.)|://[^/?#]*@)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11917", "description": "WPeMatico RSS Feed Fetcher <=2.8.11 authenticated (Subscriber+) SSRF via wpematico_test_feed AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpematico", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2025-11923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/students/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11923-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/instructors/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?forms/\\\\d+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated IDOR on ninja-forms-views REST submissions endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["idor", "missing-authorization", "unauthenticated", "rest-api", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11924-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?token/refresh(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated bearer token minting via ninja-forms-views REST token/refresh endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "rest-api", "token-minting"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11928-01": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_set_property AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11928-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_create AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11976-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fusewp_save_sync_rule", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11976", "description": "FuseWP <=1.1.23.0 CSRF to sync rule creation/edit via missing nonce and capability check on save_changes()", "method": "POST", "mode": "block", "severity": 4.3, "slug": "fusewp", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23.0"}, "RULE-CVE-2025-11986-01": {"ajax_action": "crypto_connect_ajax_process", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-11986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11986", "description": "Crypto plugin <=2.22 unauthenticated auth bypass and data injection via crypto_connect_ajax_process AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "crypto", "tags": ["missing-authentication", "authentication-bypass", "unauthenticated", "information-exposure"], "target": "plugin", "versions": "<=2.22"}, "RULE-CVE-2025-11987-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11987-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/)?(?:\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11994-01": {"action": "init", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-11994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11994", "description": "Easy Email Subscription <=1.3 unauthenticated stored XSS via subscription form name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "email-subscription-with-secure-captcha", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-11995-01": {"action": "init", "conditions": [{"name": "ARGS:eventdesc", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event description field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-02": {"action": "init", "conditions": [{"name": "ARGS:eventname", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event name field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-03": {"action": "init", "conditions": [{"name": "ARGS:eventaddress", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-04": {"action": "init", "conditions": [{"name": "ARGS:eventticket", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event ticket address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-05": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:year", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via year parameter in community_events_frontend_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-06": {"ajax_action": "community_events_admin_list", "conditions": [{"name": "ARGS:currentyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via currentyear parameter in community_events_admin_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-07": {"ajax_action": "community_events_click_tracker", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via id parameter in community_events_click_tracker AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11999-01": {"ajax_action": "addmultiplemarker_reset_map", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated map reset via addmultiplemarker_reset_map AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "data-deletion"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11999-02": {"ajax_action": "amm_save_map_api", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated API key overwrite via amm_save_map_api AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "settings-manipulation"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-12000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpfunnels/v1/settings(/|\\\\?|&|$)~"}, {"name": "ARGS:logKey", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e|%252e%252e)[%/\\\\\\\\]|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])(?:debug\\\\.log|error_log)(?:$|[\\\\\\\\/])))~i"}], "cve": "CVE-2025-12000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12000", "description": "WPFunnels <=3.6.2 authenticated arbitrary file deletion via path traversal in logKey parameter on REST settings endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpfunnels", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated (Contributor+) sensitive information exposure via {al:*} shortcode placeholders in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-02": {"ajax_action": "update_authors_list_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 unauthenticated sensitive information exposure via update_authors_list_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-03": {"ajax_action": "authors_list_display_edit_item_preview_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated sensitive information exposure via authors_list_display_edit_item_preview_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12018-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fnd]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fnd] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[rsp]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[rsp] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mol]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mol] member login message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moe]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moe] membership expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mon]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mon] no-access message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moi]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moi] session expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[org]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[org] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[out]", "type": "regex", "value": "~(?:javascript\\\\s*:|\\"\\\\s*(?:on\\\\w+\\\\s*=|>)|<\\\\s*(?:script|img|svg|iframe))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[out] logout redirect URL", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[top]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[top] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fbk]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fbk] Facebook App ID attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[map]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[map] Google Maps API key attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12021-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on wp-login.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12021-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~login-google\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on login-google.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12025-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_ytcs_title]", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via title setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12025-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_youtube_channel_id]", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|]|\\"|\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via channel ID setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12028-01": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization POST confirmation via wp-login.php?action=indieauth", "method": "POST", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-02": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization GET initiation via wp-login.php?action=indieauth", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/indieauth/1\\\\.0/auth(?:/|\\\\?|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/indieauth/1\\\\.0/auth(?:/|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (rest_route=/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12032-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_messager", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized messager setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_zalo", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized zalo setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_hotline", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized hotline setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_contact", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized contact setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12034-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][domain]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN domain settings field (domain key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12034-02": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][url]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN url settings field (legacy url key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]course-booking-system[/\\\\\\\\](includes[/\\\\\\\\])?csv-export\\\\.php([?#]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12042", "description": "Course Booking System <=6.1.5 unauthenticated booking data export via direct access to csv-export.php", "method": "GET", "mode": "block", "severity": 5.3, "slug": "course-booking-system", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-12045-01": {"ajax_action": "add-tag", "conditions": [{"name": "ARGS:tag-name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via taxonomy term name in add-tag AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/tags(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via tag name through REST /wp/v2/tags endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/categories(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via category name through REST /wp/v2/categories endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12062-01": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_name parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12062-02": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_type parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12064-01": {"ajax_action": "xyz_fbap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12064-02": {"ajax_action": "xyz_fbap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpedpcampaign"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|(?:src|href|action)\\\\s*=\\\\s*[\\"\']?javascript:|xmlns)|<\\\\s*(?:script|iframe|object|embed|svg|math)~i"}], "cve": "CVE-2025-12066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12066", "description": "WP Delete Post Copies <=6.0.2 stored XSS via campaign meta box fields on save_post", "method": "POST", "mode": "block", "severity": 4.4, "slug": "etruel-del-post-copies", "tags": ["xss", "stored-xss", "admin-plus"], "target": "plugin", "versions": "<=6.0.2"}, "RULE-CVE-2025-12067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via table cell content in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via REST API post update with table cell content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12076-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via ln_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:th_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via th_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:tw_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via tw_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:xyz_smap_bot_token", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyz_smap_bot_token parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-05": {"ajax_action": "xyz_smap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-06": {"ajax_action": "xyz_smap_del_ln_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ln_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-07": {"ajax_action": "xyz_smap_del_tw_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_tw_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-08": {"ajax_action": "xyz_smap_del_ig_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ig_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-09": {"ajax_action": "xyz_smap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-10": {"ajax_action": "xyz_smap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-11": {"ajax_action": "xyz_smap_del_twuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_twuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-12": {"ajax_action": "xyz_smap_del_iguser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_iguser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12077-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedin-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via ln_auth_err parameter on plugin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-02": {"ajax_action": "xyz_lnap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-03": {"ajax_action": "xyz_lnap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12089-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache()", "method": "POST", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12089-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "supsystic-tables"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache() (GET admin page)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12092-01-0": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[0]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-1": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[1]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-2": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[2]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-3": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[3]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-4": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[4]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12099-01": {"ajax_action": "academy/course/import_all_courses", "conditions": [{"name": "ARGS:import_all_courses", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-12099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12099", "description": "Academy LMS <=3.3.8 authenticated PHP Object Injection via import_all_courses AJAX action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "academy", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2025-12109-01": {"action": "init", "conditions": [{"name": "ARGS:asm_header_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_header_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-02": {"action": "init", "conditions": [{"name": "ARGS:asm_body_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_body_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-03": {"action": "init", "conditions": [{"name": "ARGS:asm_footer_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_footer_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12115-01": {"action": "init", "conditions": [{"name": "ARGS:add-to-cart", "type": "exists"}, {"name": "ARGS:woonp", "type": "exists"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/\\\\?|\\\\?|&)(?:add-to-cart=)~"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in add-to-cart POST", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12115-02": {"action": "init", "conditions": [{"name": "ARGS:woonp", "type": "exists"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in GET request", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12126-01": {"ajax_action": "ttbp_add_chapter", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to add chapters to others\' books via ttbp_add_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-02": {"ajax_action": "ttbp_delete_chapter", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to delete others\' chapters via ttbp_delete_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-03": {"ajax_action": "ttbp_update_chapter_order", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reorder others\' chapters via ttbp_update_chapter_order", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-04": {"ajax_action": "ttbp_assign_chapter_to_book", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reassign others\' chapters via ttbp_assign_chapter_to_book", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12129-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query-new(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query-new REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/importwp/v1/importer/\\\\d+/file(?:/|\\\\?|$)~"}, {"name": "ARGS:local_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|/etc/shadow|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}], "cve": "CVE-2025-12137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12137", "description": "Import WP <=2.14.16 authenticated (admin+) arbitrary file read via local_url parameter in REST API file_local import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "jc-importer", "tags": ["arbitrary-file-read", "path-traversal", "rest-api"], "target": "plugin", "versions": "<=2.14.16"}, "RULE-CVE-2025-12138-01": {"ajax_action": "uimptr_import_single_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php\\\\d?|phps|phtml|pht|phar)(?:[/?#%&\\"\'<>\\\\s]|%[0-9a-fA-F]{2}|$)~i"}], "cve": "CVE-2025-12138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12138", "description": "URL Image Importer <=1.0.6 authenticated (Author+) arbitrary file upload via uimptr_import_single_url AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "url-image-importer", "tags": ["arbitrary-file-upload", "content-type-spoofing", "authenticated"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-12151-01": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "add_simple_folio"}, {"name": "ARGS:portfolio_name", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via portfolio_name parameter in add_simple_folio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12151-02": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "remove_portfolio"}, {"name": "ARGS:id", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via id parameter in remove_portfolio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12159-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-03": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-04": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|<|�*60;|�*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_fe_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12160-01A": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01B": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[all]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[all] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01C": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[subscriber]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[subscriber] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01D": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[editor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[editor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01E": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[author]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[author] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01F": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[contributor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[contributor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01G": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[administrator]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[administrator] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (REST API)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12170-01": {"ajax_action": "checkbox_clean_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12170", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12170", "description": "Checkbox <=2.8.10 missing authorization on checkbox_clean_log AJAX endpoint allows unauthenticated log clearing", "mode": "block", "severity": 5.3, "slug": "checkbox", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.8.10"}, "RULE-CVE-2025-12192-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe_events/v2/[^/]{0,5}/sysinfo~"}], "cve": "CVE-2025-12192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12192", "description": "The Events Calendar <=6.15.9 unauthenticated information disclosure via sysinfo REST endpoint loose key comparison", "method": "GET", "mode": "block", "severity": 5.3, "slug": "the-events-calendar", "tags": ["information-disclosure", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-12197-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/tec/v[0-9]+/events(?:\\\\?|$)|\\\\?rest_route=/tec/v[0-9]+/events(?:&|$))~i"}, {"name": "ARGS:/^(?:search|s)$/", "type": "regex", "value": "~(?i)(?:(?:sleep|pg_sleep|benchmark)\\\\s*\\\\(|waitfor\\\\s+(?:delay|nowait)\\\\b)~"}], "cve": "CVE-2025-12197", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12197", "description": "The Events Calendar 6.15.1.1-6.15.9 unauthenticated blind SQL injection via the search parameter on the /wp-json/tec/v*/events REST endpoint. CVE-2025-12197 is an incomplete-fix continuation of CVE-2025-9807; the Custom_Tables_Query.php sink remained exploitable through 6.15.9. Fixed completely in 6.15.10.", "method": "GET", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sqli", "blind-sqli", "rest-api", "unauthenticated", "incomplete-fix"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-1232-01": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:title", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review title on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-1232-02": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review content on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-12324-01": {"ajax_action": "tablepress_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\)\\\\s*;|]*>|on[a-zA-Z]{3,} *=~i"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Stored XSS via account save action", "method": "POST", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12371-02": {"ajax_action": "nari100", "conditions": [{"name": "ARGS:by", "type": "detectXSS"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Reflected XSS via by parameter", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12375-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/printful/v2/advanced-size-chart(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~://(?:localhost|127\\\\.|10\\\\.|0\\\\.|169\\\\.254|172\\\\.(?:1[6-9]|2\\\\d|3[01])|192\\\\.168|\\\\[::1\\\\]|\\\\[0:|0\\\\.0\\\\.0\\\\.0)~i"}], "cve": "CVE-2025-12375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12375", "description": "Printful Integration for WooCommerce <=2.2.11 authenticated SSRF via advanced size chart REST API endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "printful-shipping-for-woocommerce", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.2.11"}, "RULE-CVE-2025-12376-01": {"ajax_action": "fs_api_request", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "fs_api_request"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:https?:)?//~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12376", "description": "Icon List Block <=1.2.1 authenticated (Subscriber+) SSRF via fs_api_request AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "icon-list-block", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12379-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12384-01": {"ajax_action": "bplde_save_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document creation/update via bplde_save_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-02": {"ajax_action": "bplde_get_all", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document listing via bplde_get_all AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-03": {"ajax_action": "bplde_get_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document read via bplde_get_single AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-04": {"ajax_action": "bplde_delete_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document deletion via bplde_delete_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12388-01": {"ajax_action": "bicbPipeChecker", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|localhost|0x7f000001|2130706433|\\\\[::1\\\\]|\\\\[::ffff:|169\\\\.254\\\\.)|\\\\.internal[/:\\\\s]|^(?!https?://).+://)~i"}], "cve": "CVE-2025-12388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12388", "description": "B Carousel Block <=1.1.5 authenticated (Subscriber+) SSRF via bicbPipeChecker AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "b-carousel-block", "tags": ["ssrf", "missing-authorization", "server-side-request-forgery"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12392-01": {"action": "admin_post_nopriv_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows unauthenticated tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12392-02": {"action": "admin_post_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows low-privilege tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12402-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "ARGS:update_linkedinresumeSettings", "type": "exists"}, {"name": "ARGS:linkedinId", "type": "detectXSS"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 CSRF to Stored XSS via unsanitized linkedinId parameter in admin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12402-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "REQUEST_URI", "type": "regex", "value": "~]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|%3Cscript|%3E%3Cscript~i"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 Reflected XSS via unsanitized REQUEST_URI in admin page form action", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12406-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:access_key", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via access_key parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot1", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot1 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot2", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot2 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:output_to_all", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via output_to_all parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "REQUEST_URI", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=|%3c[a-z/!]|%6a%61%76%61%73%63%72%69%70%74~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 Reflected XSS via REQUEST_URI in settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12408-01": {"action": "init", "conditions": [{"name": "ARGS:em_ajax_action", "type": "equals", "value": "get_location"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12408", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12408", "description": "Events Manager <=7.2.2.2 unauthenticated information exposure via get_location custom AJAX dispatcher", "mode": "block", "severity": 5.3, "slug": "events-manager", "tags": ["information-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.2.2.2"}, "RULE-CVE-2025-12448-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smartsupp"}, {"name": "ARGS:ssaction", "type": "equals", "value": "update"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12448", "description": "Smartsupp \\u2013 live chat, AI shopping assistant and chatbots <=3.9.1 authenticated (Subscriber+) unauthorized settings update via code parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smartsupp-live-chat", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-12449-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_settings AJAX action exposes sensitive API keys to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_settings AJAX action allows Subscriber+ to modify plugin settings and API keys", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_block_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_block_visibility AJAX action allows Subscriber+ to toggle block visibility", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-04": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_blocks_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_blocks_visibility AJAX action exposes block configuration to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/fetch_posts"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on fetch_posts AJAX action allows Subscriber+ to enumerate posts", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12450-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^litespeed~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:|\\"|\'|on(?:error|load)\\\\s*=|<\\\\s*(?:script|img|svg)\\\\b)~i"}], "cve": "CVE-2025-12473", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12473", "description": "RomethemeKit For Elementor <=1.6.8 Reflected XSS via themebuilder parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rometheme-for-elementor", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-12475-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12482-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:%\'[\\\\s]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|HAVING|WHERE|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)[\\\\s(]|/\\\\*[\\\\s\\\\S]*?\\\\*/)~i"}], "cve": "CVE-2025-12482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12482", "description": "Amelia Booking <=1.2.35 unauthenticated SQL injection via search parameter in wpamelia_api AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ameliabooking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.2.35"}, "RULE-CVE-2025-12484-01": {"ajax_action": "rafflepress_lite_giveaway_api", "conditions": [{"name": "ARGS:entry_option", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:>|\\\\bon\\\\w+\\\\s*=)|javascript\\\\s*:|&#(?:60|x3[cC]);~i"}], "cve": "CVE-2025-12484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12484", "description": "RafflePress <=1.12.19 unauthenticated stored XSS via entry_option JSON blob in giveaway API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rafflepress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.12.19"}, "RULE-CVE-2025-12493-01": {"ajax_action": "woolentor_load_more_products", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|\\\\.\\\\.%2f|\\\\.\\\\.%5c)~i"}], "cve": "CVE-2025-12493", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2025-12499-01": {"ajax_action": "grw_overview_ajax", "conditions": [{"name": "ARGS:place_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via place_id in grw_overview_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-02": {"ajax_action": "grw_feed_save_ajax", "conditions": [{"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via post_id in grw_feed_save_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-03": {"ajax_action": "grw_connect_google", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized POST data in grw_connect_google", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-04": {"ajax_action": "grw_place_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 reflected XSS via unsanitized POST data in grw_place_autocomplete", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-05": {"ajax_action": "grw_get_place", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized Google Place data in grw_get_place", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12505-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wedocs/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12505", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12505", "description": "weDocs <=2.1.14 missing authorization on REST settings update allows Subscriber+ to modify global plugin settings", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wedocs", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12537-01": {"ajax_action": "eae_save_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_save_config AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12537-02": {"ajax_action": "eae_elements_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_elements_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12538-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "regex", "value": "~^iworks_fleet_(?:person|boat|result)$~"}, {"name": "ARGS", "type": "regex", "value": "~]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|resize|pointerdown)\\\\s*=|javascript\\\\s*:|]|]|]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12538", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12538", "description": "Fleet Manager <=2.5.1 Stored XSS via unsanitized post meta in person/boat/result custom post type admin columns", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fleet", "tags": ["xss", "stored-xss", "custom-post-type"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-12539-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]tnc-toolbox-config[/\\\\\\\\]~i"}], "cve": "CVE-2025-12539", "method": "GET", "mode": "block", "severity": 10.0, "slug": "tnc-toolbox", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-12560-01": {"ajax_action": "b2s_get_full_content", "conditions": [{"name": "ARGS:post_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12560", "description": "Blog2Social <=8.6.0 authenticated (Subscriber+) blind SSRF via post_url in b2s_get_full_content AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "blog2social", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.6.0"}, "RULE-CVE-2025-12569-01": {"action": "init", "conditions": [{"name": "ARGS:redirect", "type": "regex", "value": "~^(?:https?:|//)~i"}], "cve": "CVE-2025-12569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12569", "description": "WP Front User Submit / Front Editor <=4.9.5 open redirect via unvalidated redirect parameter in registration/login shortcode form submission", "method": "POST", "mode": "block", "severity": 4.7, "slug": "front-editor", "tags": ["open-redirect", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=4.9.5"}, "RULE-CVE-2025-12583-01": {"ajax_action": "neofix_sdl_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_add AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-02": {"ajax_action": "neofix_sdl_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_edit AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-03": {"ajax_action": "neofix_sdl_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_delete AJAX action allowing Subscriber+ unauthorized deletion", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-04": {"ajax_action": "neofix_sdl_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_restore AJAX action allowing Subscriber+ unauthorized restore", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-05": {"ajax_action": "neofix_sdl_get_file_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_get_file_url AJAX action allowing Subscriber+ information disclosure", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12621-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_ID", "type": "exists"}, {"name": "ARGS:status", "type": "regex", "value": "~(?i)^\\\\s*(approved|refused)\\\\s*$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12621", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12621", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.42 incorrect authorization on fr_refund_request AJAX action allows Contributor+ to approve/refuse refunds", "method": "POST", "mode": "block", "severity": 5.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["incorrect-authorization", "broken-access-control", "woocommerce"], "target": "plugin", "versions": "<=1.0.42"}, "RULE-CVE-2025-12628-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "validate_2fa"}, {"name": "ARGS:provider", "type": "regex", "value": "~^(?i)backup(?:_|%5[fF])codes$~"}, {"name": "ARGS:wp-2fa-backup-code", "type": "exists"}], "cve": "CVE-2025-12628", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12628", "description": "WP 2FA <=2.9.3 second factor bypass via brute-force of low-entropy backup codes on validate_2fa endpoint", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-2fa", "tags": ["authentication-bypass", "insufficient-entropy", "brute-force"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-12630-01": {"ajax_action": "upload_am_get_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option disclosure via upload_am_get_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12630-02": {"ajax_action": "upload_am_update_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option update via upload_am_update_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12633-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v1/commerce/stripe/return(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12633", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12633", "description": "Bookit <=2.5.0 missing authorization on Stripe Connect return REST endpoint allows unauthenticated Stripe account linkage", "method": "GET", "mode": "block", "severity": 7.5, "slug": "bookit", "tags": ["missing-authorization", "unauthenticated", "rest-api", "stripe-connect"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/link-status-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on link-status-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-1264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/links-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on links-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-12641-01": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12641-02": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12643-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12643-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post_content param", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12646-01": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12646-02": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler (GET variant)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12650-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12650-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12654-01": {"ajax_action": "wpvividstg_check_filesystem_permissions_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:create_new_wp", "type": "equals", "value": "1"}, {"name": "ARGS:pwd", "type": "regex", "value": "~(^/|^[A-Za-z]:\\\\\\\\|\\\\.{2}|[/\\\\\\\\]{2,}|/etc/|^/var/|^/tmp/|/\\\\.|\\\\\\\\\\\\.)~i"}], "cve": "CVE-2025-12654", "method": "POST", "mode": "block", "severity": 2.7, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.120"}, "RULE-CVE-2025-12658-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12661-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post[.]php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12661-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|[?])rest_route=)/wp/v2/posts(/|[?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12673-01": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-02": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-03": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-04": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12677-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kiot(?:viet(?:sync)?)/(?:v[0-9]+/)?webhook(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12677", "description": "KiotViet Sync <=1.8.5 unauthenticated sensitive information exposure via webhook REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "kiotvietsync", "tags": ["information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-12681-01": {"ajax_action": "sce_get_comment", "conditions": [{"name": "ARGS:comment_id", "type": "exists"}], "cve": "CVE-2025-12681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12681", "description": "Simple Comment Editing <=3.1.0 unauthenticated sensitive information exposure via sce_get_comment AJAX action", "mode": "block", "severity": 5.3, "slug": "simple-comment-editing", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-12682-01": {"action": "init", "conditions": [{"name": "FILES:file_during_checkout", "type": "exists"}], "cve": "CVE-2025-12682", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easy-upload-files-during-checkout", "target": "plugin", "versions": "<=2.9.8"}, "RULE-CVE-2025-12691-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12691-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12707-01": {"ajax_action": "owt_lib_handler", "conditions": [{"name": "ARGS:bid", "type": "regex", "value": "~(?:VU5JT04=|U0VMRUNU|SU5TRVJU|VVBEQVRF|REVMRVRF|RFJPUA==|QU5E|T1I=|U0xFRVA=|RVhUUkFDVFZBTFVF|Q09OQ0FU|T1JERVIgQlk=|R1JPVVAgQlk=)~i"}], "cve": "CVE-2025-12707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12707", "description": "Library Management System <=3.2.1 unauthenticated SQL injection via bid parameter in owt_lib_handler AJAX handler", "mode": "block", "severity": 7.5, "slug": "library-management-system", "tags": ["sql-injection", "unauthenticated", "base64-encoded-parameter"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-12709-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/interact/v1/update_interaction(?:/|\\\\?|&|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]*>|]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12709", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12709", "description": "Interactions <= 1.3.1 Authenticated (Contributor+) Stored XSS via event selectors in update_interaction REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "interactions", "tags": ["xss", "stored-xss", "rest-api", "missing-capability"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-12718-01": {"ajax_action": "qcf_validate_form", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2025-12718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12718", "description": "Quick Contact Form <=8.2.6 unauthenticated open mail relay via email header injection in qcf_validate_form AJAX handler", "method": "POST", "mode": "block", "severity": 5.8, "slug": "quick-contact-form", "tags": ["email-header-injection", "open-mail-relay", "unauthenticated", "improper-input-validation"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2025-12721-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fflcockpit/v1/server_status(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12721", "description": "g-FFL Cockpit <=1.7.1 unauthenticated information disclosure via /fflcockpit/v1/server_status REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "g-ffl-cockpit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-12746-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "detectXSS"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via search parameter in front-end template", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12746-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(\\\\\\"|\')\\\\s*on\\\\w+\\\\s*=|<(script|svg|iframe|img)[\\\\s/>]|javascript\\\\s*:~i"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via arbitrary GET parameters reflected into hidden form fields", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12747-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?i)^/wp-content/uploads/tainacan-items/\\\\d+/_x_\\\\d+/~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12747", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12747", "description": "Tainacan <=1.0.0 unauthenticated information exposure via direct access to private files in tainacan-items uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "tainacan", "tags": ["information-exposure", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12754-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[geopost\\\\b[^\\\\]]*(?:height|width)\\\\s*=\\\\s*[^\\\\]]*(?:\'\\";&|`]~"}], "cve": "CVE-2025-12787", "method": "POST", "mode": "block", "severity": 5.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12800-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "su_generator_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_csv_table[^\\\\]]*url\\\\s*=~i"}], "cve": "CVE-2025-12800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12800", "description": "Shortcodes Ultimate <=7.4.5 Server-Side Request Forgery via su_csv_table shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["ssrf", "server-side-request-forgery", "shortcode"], "target": "plugin", "versions": "<=7.4.5"}, "RULE-CVE-2025-12804-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (classic editor injection phase)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12814-01": {"ajax_action": "siteseo_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings reset via siteseo_reset_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-02": {"ajax_action": "siteseo_export_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings export via siteseo_export_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-03": {"ajax_action": "siteseo_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings import via siteseo_import_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "settings-injection"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-04": {"ajax_action": "siteseo_migrate_seo", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized SEO data migration via siteseo_migrate_seo AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12824-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[player_leaderboard\\\\b[^\\\\]]*mode\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data)://)~i"}], "cve": "CVE-2025-12824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12824", "description": "Player Leaderboard <=1.0.2 authenticated (Contributor+) Local File Inclusion via player_leaderboard shortcode mode attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "player-leaderboard", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12824-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[player_leaderboard\\\\b[^\\\\]]*mode\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data)://)~i"}], "cve": "CVE-2025-12824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12824", "description": "Player Leaderboard <=1.0.2 authenticated (Contributor+) Local File Inclusion via REST API post content containing malicious player_leaderboard shortcode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "player-leaderboard", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12826-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cptui_process_post_type"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12826", "description": "Custom Post Type UI <=1.18.0 missing authorization on custom post type modification via cptui_process_post_type", "method": "POST", "mode": "block", "severity": 4.8, "slug": "custom-post-type-ui", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2025-12826-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cptui_process_taxonomy"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12826", "description": "Custom Post Type UI <=1.18.0 missing authorization on custom taxonomy modification via cptui_process_taxonomy", "method": "POST", "mode": "block", "severity": 4.8, "slug": "custom-post-type-ui", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2025-12830-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "contains", "value": "better-slider"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~better-slider[\\\\s\\\\S]{0,500}(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|embed|object|details|math)[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12830", "description": "Better Elementor Addons <=1.5.5 Stored XSS via Slider widget title_html_tag and title fields in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "better-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.5"}, "RULE-CVE-2025-12836-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s(?:on\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description event-handler injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12836-02": {"action": "init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<(?:script[\\\\s>]|/script>|iframe[\\\\s>]|svg[\\\\s/>]|embed[\\\\s>]|object[\\\\s>]|scrscriptipt\\\\b)|\\\\b(?:href|src|xlink:href)\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description dangerous element injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12837-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:waf_probe", "type": "regex", "value": "~]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in REST API content save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12837-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/bookit/v1/commerce/stripe/return(?:/|\\\\?|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12841-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookit/v1/commerce/stripe/return(?:/|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint (rest_route fallback)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12844-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTranscribeAudio(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTranscribeAudio REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleVisionQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleVisionQuery REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleFastTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleFastTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleJsonQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleJsonQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12845-01": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12845", "description": "Tablesome <=1.2.1 missing authorization on get_tables_data AJAX action allows subscriber+ to retrieve sensitive table data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12851-01": {"action": "init", "conditions": [{"name": "ARGS:controller", "type": "regex", "value": "~(?:[\\\\.\\\\\\\\/-]|%2[dDeEfF]|%5[cC])~"}], "cve": "CVE-2025-12851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12851", "description": "My auctions allegro <=3.6.32 unauthenticated Local File Inclusion via controller parameter on init hook", "mode": "block", "severity": 8.1, "slug": "my-auctions-allegro-free-edition", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=3.6.32"}, "RULE-CVE-2025-1287-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:text_days|text_hours|text_minutes|text_seconds|cpybtntext|lanugaetext|copiedbtntext|cpyerrbtntext|dwnldBtnText|nav_dots_tooltips|fp-slideid)[^}]{0,200}(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|object|embed|math|details|body|marquee)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12904", "description": "H5PxAPIkatchu <= 0.4.17 Unauthenticated Stored XSS via insert_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "h5pxapikatchu", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.17"}, "RULE-CVE-2025-1291-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-12934-01": {"ajax_action": "fl_builder_duplicate_wpml_layout", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}, {"name": "ARGS:original_post_id", "type": "exists"}], "cve": "CVE-2025-12934", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12934", "description": "Beaver Builder <= 2.9.4.1 missing authorization on duplicate_wpml_layout AJAX handler allows Subscriber+ arbitrary post update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-update"], "target": "plugin", "versions": "<=2.9.4.1"}, "RULE-CVE-2025-12935-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12935-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12955-01": {"ajax_action": "pisol_live_orders", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12955", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12955", "description": "Live Sales Notification for WooCommerce <=2.3.39 missing authorization on pisol_live_orders AJAX handler exposing customer order data", "mode": "block", "severity": 7.5, "slug": "live-sales-notifications-for-woocommerce", "tags": ["missing-authorization", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.3.39"}, "RULE-CVE-2025-12960-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12960-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12963-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazytasks/api/v1/user/role/edit(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12963", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lazytasks-project-task-management", "target": "plugin", "versions": "<=1.2.29"}, "RULE-CVE-2025-12964-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_title_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_subtitle_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_subtitle_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdal_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdal_title_tag in Products Awesome List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpcar_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpcar_title_tag in Products Carousel Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-05": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdeg_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdeg_title_tag in Products Grid/Tab Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-06": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdel_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdel_title_tag in Products List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12973-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "s2b_store_chatbot_upload"}, {"name": "FILES:s2baia_chatbot_config_database", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12973", "description": "S2B AI Assistant <=1.7.8 arbitrary file upload via s2b_store_chatbot_upload admin-post action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "s2b-ai-assistant", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.7.8"}, "RULE-CVE-2025-12984-01": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-12984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12984", "description": "Advanced Ads <=2.0.15 authenticated (admin+) SQL injection via order parameter in placement list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "advanced-ads", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.0.15"}, "RULE-CVE-2025-13006-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/fsd(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/fsd REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses/[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses/{id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys/survey_id=[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys/survey_id={id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13031-01": {"action": "admin_post_save_wpematico_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Stored XSS via unsanitized settings output in settings_form()", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-02": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:return_url", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:(?:text/html|application/xhtml)|on\\\\w+\\\\s*=|]|<[^>]+[\\\\s/]+on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13048", "description": "Official StatCounter Plugin <=2.1.0 Authenticated (Contributor+) Stored XSS via Nickname", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored-xss", "missing-output-escaping"], "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-13054-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13072-01": {"action": "init", "conditions": [{"name": "ARGS:utm_source", "type": "detectXSS"}], "cve": "CVE-2025-13072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13072", "description": "HandL UTM Grabber <=2.8 Reflected XSS via utm_source query parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2025-13073-01": {"ajax_action": "handl_get_zapier_log", "conditions": [{"name": "ARGS:handl_landing_page", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13073", "description": "HandL UTM Grabber <=2.8 reflected XSS via handl_landing_page in handl_get_zapier_log AJAX handler", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<2.8.1"}, "RULE-CVE-2025-1309-01": {"ajax_action": "uip_save_form_as_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1309", "description": "UiPress Lite <=3.5.04 missing authorization on uip_save_form_as_option AJAX handler allows arbitrary options update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "uipress-lite", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=3.5.04"}, "RULE-CVE-2025-1310-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~job-postings-get-file/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (rewrite rule path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1310-02": {"action": "parse_request", "conditions": [{"name": "ARGS:job_postings_get_file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\.%2f|\\\\.\\\\.%5c|\\\\.\\\\.%252f|\\\\.\\\\.%255c|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|^/)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (query string path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1311-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcfmmp/v1/deliveries/[^/]*[^0-9/][^/]*~i"}], "cve": "CVE-2025-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1311", "description": "WCFM Marketplace REST API <=1.6.2 authenticated SQL injection via non-numeric id path segment in /wcfmmp/v1/deliveries/{id}", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wcfm-marketplace-rest-api", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2025-1312-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1312-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-13153-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "logosliderwp"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on logosliderwp post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13153-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "lgx_lsp_shortcodes"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on lgx_lsp_shortcodes post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13156-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|aspx?|jspx?|cfm|user\\\\.ini)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-13156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13156", "description": "VitePos Lite <=3.3.0 authenticated arbitrary file upload via REST API leading to RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vitepos-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-13206-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor first name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13206-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor last name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13217-01": {"ajax_action": "um_update_profile_full", "conditions": [{"name": "ARGS:youtube_video", "type": "exists"}, {"name": "ARGS:youtube_video", "type": "regex", "value": "~(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13217", "description": "Ultimate Member <=2.11.0 Stored XSS via youtube_video profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.11.0"}, "RULE-CVE-2025-1324-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[public-form"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[public-form\\\\s[^\\\\]]*(?:\\"\']|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13311", "description": "Just Highlight <=1.0.3 authenticated (Administrator+) stored XSS via sigijh_color_select setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "just-highlight", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13314-01": {"ajax_action": "filter_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on filter_save_settings AJAX action allows unauthenticated settings modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "settings-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13314-02": {"ajax_action": "add_filter_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on add_filter_options AJAX action allows unauthenticated post creation and meta write", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "arbitrary-post-creation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13320-01": {"action": "admin_init", "conditions": [{"name": "ARGS:account[user_avatar][path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|[/\\\\\\\\]etc[/\\\\\\\\]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-13320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13320", "description": "WP User Manager <=2.9.12 arbitrary file deletion via path traversal in avatar path parameter during profile update", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-user-manager", "tags": ["arbitrary-file-deletion", "path-traversal", "external-file-control"], "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-13329-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/add-image-data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:fileName", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2025-13329", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-uploader-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13334-01": {"ajax_action": "blaze_demo_importer_install_demo", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:reset", "type": "equals", "value": "true"}], "cve": "CVE-2025-13334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13334", "description": "Blaze Demo Importer <=1.0.13 missing authorization on blaze_demo_importer_install_demo AJAX action allows subscriber+ site reset", "method": "POST", "mode": "block", "severity": 8.1, "slug": "blaze-demo-importer", "tags": ["missing-authorization", "broken-access-control", "database-reset"], "target": "plugin", "versions": "<=1.0.13"}, "RULE-CVE-2025-13342-02": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13342", "description": "Frontend Admin (ACF Frontend Form Element) <=3.28.20 unauthenticated arbitrary options update via update_field AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.28.20"}, "RULE-CVE-2025-13358-01": {"ajax_action": "ccpcaCreatePage", "conditions": [{"type": "missing_capability", "value": "publish_pages"}], "cve": "CVE-2025-13358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13358", "description": "CodeConfig Accessibility <=1.0.0 missing authorization on ccpcaCreatePage AJAX action allows Subscriber+ arbitrary page creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "codeconfig-accessibility", "tags": ["missing-authorization", "broken-access-control", "arbitrary-content-creation"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-13359-01": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_orderby in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-02": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_order in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-03": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_maximum_terms", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 SQL injection via existing_terms_maximum_terms in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-04": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_orderby in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-05": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_order in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13364-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13367-01": {"action": "init", "conditions": [{"name": "ARGS:username", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via username GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-02": {"action": "init", "conditions": [{"name": "ARGS:info", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via info GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-03": {"action": "init", "conditions": [{"name": "ARGS:transaction_id", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via transaction_id GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13370-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) time-based SQL injection via id parameter on pl-add admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13370-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) SQL injection via id parameter on pl-add admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13376-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "projectlist-add"}, {"name": "FILES:pl_image", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13376", "description": "ProjectList <=0.3.0 authenticated arbitrary file upload via pl_image on Add Project page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "projectlist", "tags": ["arbitrary-file-upload", "file-upload", "authenticated"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13383-01": {"action": "init", "conditions": [{"name": "ARGS:jbbrd_save_search", "type": "equals", "value": "1"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|iframe|object|embed|svg|math|img|video|audio|body|details|marquee|isindex|form|input|button|select|textarea|keygen|meta|link|base|style)[\\\\s/>]|\\\\bon(?:error|load|focus|click|mouse(?:over|out|enter)|change|blur|submit|reset|key(?:up|down|press)|contextmenu|dblclick|drag|drop|input|invalid|scroll|wheel|animat(?:ion|ed)|transition)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13383", "description": "Job Board by BestWebSoft <=1.2.1 stored XSS via CSRF through unsanitized $_GET array storage in save-search", "method": "GET", "mode": "block", "severity": 6.1, "slug": "job-board", "tags": ["xss", "stored-xss", "csrf", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-13387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_first_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_first_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_last_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_last_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13403-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-in via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13403-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_no_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-out via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13409-01": {"ajax_action": "fv_get_analytics_data", "conditions": [{"name": "ARGS:params", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13409", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13409", "description": "Form Vibes <=1.4.13 authenticated SQL injection via params parameter in fv_get_analytics_data AJAX handler", "mode": "block", "severity": 4.9, "slug": "form-vibes", "tags": ["sql-injection", "authenticated", "admin-plus"], "target": "plugin", "versions": "<=1.4.13"}, "RULE-CVE-2025-13414-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export_businesses", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13414-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export (alt trigger cdash_export)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13419-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bfe/v1/revert(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-13419", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13419", "description": "Front Editor <=5.0.0 unauthenticated arbitrary media deletion via /bfe/v1/revert REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "front-editor", "tags": ["missing-authorization", "unauthenticated", "rest-api", "idor"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-13431-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_load_report AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13431-02": {"ajax_action": "slimstat_fetch_chart_data", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_fetch_chart_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13440-01": {"action": "admin_post_premmerce_delete_wishlist", "conditions": [{"name": "ARGS:wishlist", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13440", "description": "Premmerce Wishlist for WooCommerce <=1.1.10 missing authorization on deleteWishlist via admin_post action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "premmerce-woocommerce-wishlist", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2025-13448-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13448-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13463-01": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_get_html AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13463-02": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_save AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13486-01": {"ajax_action": "acfe/form/render_form_ajax", "conditions": [{"name": "ARGS:_acf_form", "type": "regex", "value": "~(?i)\\\\b(system|exec|passthru|shell_exec|popen|proc_open|file_put_contents|assert|eval)\\\\b~i"}], "cve": "CVE-2025-13486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": ">=0.9.0.5 <=0.9.1.1"}, "RULE-CVE-2025-13497-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/suremails/attachments/[^/]+\\\\.(?:php\\\\d*|phtml|phar|phps|pht|phpt|inc)(?:\\\\?|$)~i"}], "cve": "CVE-2025-13516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13516", "description": "SureMail <=1.9.0 unauthenticated RCE via direct access to uploaded PHP files in suremails attachments directory", "mode": "block", "severity": 8.1, "slug": "suremails", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "dangerous-file-type"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-13525-01": {"action": "init", "conditions": [{"name": "ARGS:order_by", "type": "detectXSS"}], "cve": "CVE-2025-13525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13525", "description": "WP Directory Kit <=1.4.5 Reflected Cross-Site Scripting via order_by parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpdirectorykit", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2025-13534-01": {"ajax_action": "eh_crm_edit_agent", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:user_id", "type": "regex", "value": "~.+~"}, {"name": "ARGS:rights", "type": "regex", "value": "~.+~"}], "cve": "CVE-2025-13534", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2025-13537-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-02": {"ajax_action": "dslc-ajax-save-draft-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-draft-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-03": {"ajax_action": "dslc-ajax-import-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-template AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-04": {"ajax_action": "dslc-ajax-import-modules-section", "conditions": [{"name": "ARGS:dslc_modules_section_code", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-modules-section AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~change-ad__content~"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13592-02": {"ajax_action": "advads-ad-injection-content", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~change-ad__content\\\\s*=~i"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in AJAX injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode", "ajax"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13604-03": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:\\\\s*(?:text/html|application/xhtml))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via javascript:/data: URI scheme in GET query parameter values", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:<|%3[Cc])(?:script|img|svg|iframe|object|embed|body|input|details|math|video|audio|style|form|base|link|meta)(?:\\\\s|/|>|%20|%09|%2[Ff]|%3[Ee])~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via HTML tags in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:%6[Ff]|o)n(?:error|load|click|mouseover|focus|toggle)(?:\\\\s*(?:=|%3[Dd]))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via event handlers in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13608-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-13608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-1361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "ip2location-country-blocker"}, {"type": "missing_capability", "value": "administrator"}], "cve": "CVE-2025-1361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1361", "description": "IP2Location Country Blocker <=2.38.8 missing authorization on admin_init allows unauthenticated settings disclosure", "mode": "block", "severity": 5.3, "slug": "ip2location-country-blocker", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.38.8"}, "RULE-CVE-2025-13610-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[RM_Forms\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:|on\\\\w+\\\\s*=)[^?]*(?:\\\\?|$)~i"}], "cve": "CVE-2025-13622", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13622", "description": "Jabbernotification <=0.99-RC2 reflected XSS via PATH_INFO in admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "jabberbenachrichtigung", "tags": ["xss", "reflected-xss", "path-info"], "target": "plugin", "versions": "<=0.99-RC2"}, "RULE-CVE-2025-13626-01": {"ajax_action": "mylco_pagerank", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_pagerank AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-02": {"ajax_action": "mylco_alexa", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_alexa AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php/(?:[^?]*(?:[<>\\"\']|%3c|%3e|%22|%27).*)?[?&]page=mylco(?:&|$)~i"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via $_SERVER[\'PHP_SELF\'] path-info injection on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13641-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13645-01": {"ajax_action": "modula_unzip_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13645", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file/directory deletion via path traversal in ajax_unzip_file \\u2014 over-protection capability gate (payload is in zip binary, not HTTP params)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated", "over-protection"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13646-01": {"ajax_action": "modula_unzip_file", "conditions": [{"name": "ARGS:fileID", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13646", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file upload via modula_unzip_file AJAX handler", "method": "POST", "mode": "block", "severity": 6.6, "slug": "modula-best-grid-gallery", "tags": ["arbitrary-file-upload", "race-condition", "authenticated"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13678-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13678-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13679-01": {"ajax_action": "tutor_order_details", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13679", "description": "Tutor LMS <=3.9.3 missing authorization on tutor_order_details AJAX action allows subscriber+ to exfiltrate order PII", "mode": "block", "severity": 6.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2025-13681-01": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e[%2f%5c]){2,})~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated path traversal via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "missing-authorization"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13681-02": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated sensitive file read via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "sensitive-file-disclosure"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13682-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:bulk_trail_networks_changed", "type": "regex", "value": "~<[a-zA-Z]{2,}|]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13730-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[openid_connect_generic_auth_url\\\\b[^\\\\]]*(?:<[^>]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13732-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Display Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Nickname on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User First Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:last_name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Last Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13838-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13838-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13840-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13840-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13846-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13846-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13852-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13852-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13853-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]nn-tech[^]]*data_tech *=[^]]*(<[^>]+on[a-zA-Z]+=|]+onerror|#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via form field values on hf_form_submit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13861-02": {"action": "init", "conditions": [{"name": "ARGS:_hf_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|svg|img|iframe|object|embed|details|marquee|video|audio|body|math|xmp|isindex|style|link|base|meta|form|input|button|select|textarea|keygen|source|track|frameset|frame|applet|xml)[\\\\s/>#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via non-AJAX form submission with _hf_form_id", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13864-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/breeze/v1/clear-all-cache(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13864", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13864", "description": "Breeze <=2.2.21 unauthenticated cache clearing via REST API endpoint breeze/v1/clear-all-cache", "method": "POST", "mode": "block", "severity": 5.3, "slug": "breeze", "tags": ["missing-authorization", "unauthenticated", "rest-api", "cache-deletion"], "target": "plugin", "versions": "<=2.2.21"}, "RULE-CVE-2025-13880-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated access to advanced settings via REST API (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13880-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated modification of advanced settings via REST API (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13886-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13887-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13887-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13889-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13889-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13896-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[igp-wp\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*[<>;()\\\\\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13896", "description": "Social Feed Gallery Portfolio <=1.3 Stored XSS via igp-wp shortcode id attribute (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-feed-gallery-portfolio", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-13897-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_name metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13897-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_company", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_company metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13898-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via [ultra_skype] shortcode btn_id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13898-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via REST API post creation with [ultra_skype] shortcode btn_id attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13904-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gancio-events?\\\\b[^\\\\]]*(?:on[a-z]+=|javascript\\\\s*:|\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13906-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:linechart|barchart|piechart)\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13907-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]button[^]]*(?:\\\\b(?:href|url|link)\\\\s*=\\\\s*([\\"\'])\\\\s*(?:javascript:|data:)|on(?:abort|blur|change|click|dblclick|error|focus|input|keydown|keypress|keyup|load|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|reset|resize|scroll|submit|unload)\\\\s*=|]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13908-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[the_tooltip\\\\b[^\\\\]]*(?:[\\\\s\\"\']on(?:click|error|load|mouseover|focus|blur|toggle|change|submit|key(?:down|up|press)|pointer(?:down|up)|mouseenter|mouseleave)\\\\s*=|javascript:|]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13958-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13963-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*(?:tmpl|prefix|suffix)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode attributes (tmpl/prefix/suffix)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13963-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*\\\\][^\\\\[]*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode enclosed content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13964-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_add_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section creation via lp-load-ajax=course_add_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-02": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section update via lp-load-ajax=course_update_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_delete_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section deletion via lp-load-ajax=course_delete_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated section reorder via lp-load-ajax=course_update_section_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-05": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "create_item_add_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item creation via lp-load-ajax=create_item_add_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-06": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "add_items_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item addition via lp-load-ajax=add_items_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-07": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "delete_item_from_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item deletion via lp-load-ajax=delete_item_from_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-08": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_section_and_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item move via lp-load-ajax=update_item_section_and_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-09": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_items_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item reorder via lp-load-ajax=update_items_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-10": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_of_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item update via lp-load-ajax=update_item_of_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13972-01": {"action": "parse_request", "conditions": [{"name": "ARGS:wht_download_big_object", "type": "exists"}, {"name": "ARGS:wht_download_big_object_origin", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|[\\\\\\\\/]proc[\\\\\\\\/]|[\\\\\\\\/]var[\\\\\\\\/]log|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-13972", "mode": "block", "severity": 4.9, "slug": "watchtowerhq", "target": "plugin", "versions": "<=3.16.0"}, "RULE-CVE-2025-13973-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/uploads/stickeasy-protected-contact-form/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/uploads/stickeasy-protected-contact-form/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.0 uploads directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13973-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/spcf-logs/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/spcf-logs/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.1 spcf-logs directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13974-01": {"ajax_action": "thwecmf_template_actions", "conditions": [{"name": "ARGS:contents", "type": "regex", "value": "~<\\\\s*(?:script|iframe|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|change|submit|input)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]+\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13974", "description": "Email Customizer for WooCommerce <=2.6.7 authenticated stored XSS via template content save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "email-customizer-for-woocommerce", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.6.7"}, "RULE-CVE-2025-13977-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13989-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13989-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13999-01": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|tftp|ldap|ssh)://~i"}, {"name": "ARGS:url", "type": "exists"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data AJAX action url parameter", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-13999-02": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0177\\\\.|0x7f|2130706433|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data targeting localhost/internal IPs", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-14000-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[restrict\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [restrict] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14000-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[register_form\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [register_form] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14001-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14001-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action2", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action2 parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14030-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14032-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14032-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14039-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_client_name", "type": "regex", "value": "~(?:]|]+onerror\\\\s*=|]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_client_name meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~(?:]|]+onerror\\\\s*=|]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|])~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_link meta field (HTML injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via javascript protocol in _simple_folio_item_link href", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14049-01": {"action": "admin_post_nopriv_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on unauthenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-14049-02": {"action": "admin_post_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on authenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-1405-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[show_products"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[show_products\\\\s[^\\\\]]*(?:on\\\\w+\\\\s*=|]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_post_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-14056-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cptui_tools"}, {"name": "ARGS:cptui_tax_import", "type": "regex", "value": "~<[a-zA-Z!/][^>]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_tax_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-1406-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-1406-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in REST content field", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-14061-01": {"ajax_action": "gdpr_delete_policy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14061", "description": "WP Cookie Consent <=4.0.7 missing authorization on gdpr_delete_policy_data AJAX handler allowing unauthenticated arbitrary post deletion", "mode": "block", "severity": 5.3, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "arbitrary-post-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-14064-01": {"ajax_action": "get_board", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_board AJAX endpoint allows unauthorized access to any group task board", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-02": {"ajax_action": "add_new_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_new_task AJAX endpoint allows unauthorized task creation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-03": {"ajax_action": "edit_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_task AJAX endpoint allows unauthorized task modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-04": {"ajax_action": "delete_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on delete_task AJAX endpoint allows unauthorized task deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-05": {"ajax_action": "reorder_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on reorder_task AJAX endpoint allows unauthorized task reordering", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-06": {"ajax_action": "get_tasks", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_tasks AJAX endpoint allows unauthorized task data access", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-07": {"ajax_action": "edit_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_list AJAX endpoint allows unauthorized list modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-08": {"ajax_action": "users_autocomplete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on users_autocomplete AJAX endpoint allows unauthorized user enumeration", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-09": {"ajax_action": "add_users_to_assign_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_users_to_assign_list AJAX endpoint allows unauthorized user assignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14069-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14069-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on user-edit profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14079-01": {"ajax_action": "eh_crm_ticket_general", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14079", "description": "ELEX WordPress HelpDesk & Customer Support Ticket System <=3.3.5 missing authorization on eh_crm_ticket_general AJAX settings update", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2025-14109-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14109-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14110-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(list-pages|child-pages|tree-pages)\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:<|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14110", "description": "WP Js List Pages Shortcodes <=1.21 stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-js-list-pages-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.21"}, "RULE-CVE-2025-14112-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14112-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14113-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14113-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14114-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14114-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[atvc_video_play\\\\b[^\\\\]]*(?:on[a-zA-Z]+=|javascript:|]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14142", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14142", "description": "Electric Enquiries <=1.1 Stored XSS via button attribute of electric-enquiry shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "electric-enquiries", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-14143-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute containing javascript URI in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute with tag injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (event handler)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14144-01": {"ajax_action": "ajax_live_preview", "conditions": [{"name": "ARGS:shortcodeData", "type": "regex", "value": "~]*>|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseout|mousemove|keydown|keyup|keypress|submit|change|input|animationend|animationstart)\\\\s*=~i"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via shortcodeData in ajax_live_preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14144-02": {"ajax_action": "mstoic_shortcodes_print_images", "conditions": [{"name": "ARGS:mstoicImgCount", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via mstoicImgCount in mstoic_shortcodes_print_images AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14147-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14147-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14151-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:outbound_resource", "type": "regex", "value": "~(?i)(?:<\\\\s*(?:script|svg)\\\\b|\\\\bon(?:load|error)\\\\s*=|\\\\bjavascript\\\\s*:)~"}], "cve": "CVE-2025-14151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14151", "description": "SlimStat Analytics <=5.3.2 unauthenticated stored XSS via outbound_resource parameter in slimtrack AJAX action", "mode": "block", "severity": 6.1, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.2"}, "RULE-CVE-2025-14154-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~join_chat$~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14154", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14154", "description": "Better Messages <=2.10.2 stored XSS via unauthenticated guest display name in join chat", "method": "POST", "mode": "block", "severity": 6.1, "slug": "bp-better-messages", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-14156-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fox-lms/v1/payments/create-order(/|\\\\?|&|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-14156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14156", "description": "Fox LMS >=1.0.4.7 <=1.0.5.1 unauthenticated privilege escalation via role parameter in create-order REST endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fox-lms", "tags": ["privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.0.4.7 <=1.0.5.1"}, "RULE-CVE-2025-14172-01": {"ajax_action": "cwpp_trigger_flush_rewrite_rules", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14172", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14172", "description": "WP Page Permalink Extension <=1.5.4 missing authorization on cwpp_trigger_flush_rewrite_rules AJAX action allows Subscriber+ to flush rewrite rules", "mode": "block", "severity": 6.5, "slug": "change-wp-page-permalinks", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-14293-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2025-14293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14293", "description": "WP Job Portal <=2.4.0 authenticated arbitrary file read via path traversal in filename parameter", "mode": "block", "severity": 6.5, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-read", "local-file-inclusion"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-14298-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php, event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (style breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-02": {"ajax_action": "validate_sso_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on validate_sso_token AJAX handler allows Subscriber+ to validate/consume admin SSO token", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-03": {"ajax_action": "check_sso_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on check_sso_status AJAX handler allows Subscriber+ to query SSO status", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14388-01": {"action": "init", "conditions": [{"name": "ARGS:phast", "type": "exists"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:%00|%2500|\\\\x00)~"}], "cve": "CVE-2025-14388", "method": "GET", "mode": "block", "severity": 9.8, "slug": "phastpress", "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-1440-01": {"ajax_action": "aip_map_url_action", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://)~i"}], "cve": "CVE-2025-1440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1440", "description": "Advanced iFrame <=2024.5 unauthenticated URL mapping injection via aip_map_url_action - blocks non-HTTP(S) scheme URLs (javascript, data, ftp, etc.)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "advanced-iframe", "tags": ["improper-input-validation", "option-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2024.5"}, "RULE-CVE-2025-1441-01": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_no_results", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_no_results param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-02": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_number_of_words param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-03": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_view_result_text param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-04": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_ajax_search_link_target param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-05": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:grid_settings", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (grid_settings JSON param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-14437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-action=download~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-module=~i"}], "cve": "CVE-2025-14437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14437", "description": "Hummingbird Performance <=3.18.0 unauthenticated log file download via Logger::process_actions wphb-log-action parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hummingbird-performance", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "log-file-download"], "target": "plugin", "versions": "<=3.18.0"}, "RULE-CVE-2025-14440-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "jay_login_register_switch_back"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14440", "method": "GET", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.4.01"}, "RULE-CVE-2025-14441-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popupkit/v1/subscribers(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14441", "description": "PopupKit (Starter Templates & Starter Blocks for Starter Sites) <=2.2.0 missing authorization on DELETE /popupkit/v1/subscribers REST endpoint allows authenticated subscriber+ arbitrary subscriber data deletion", "method": "DELETE", "mode": "block", "severity": 5.3, "slug": "popup-builder-block", "tags": ["missing-authorization", "broken-access-control", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14442-01": {"ajax_action": "ays_sccp_results_export_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_file AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14442-02": {"ajax_action": "ays_sccp_results_export_filter", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_filter AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14445-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "points_image"}, {"name": "ARGS", "type": "regex", "value": "~(?:PHNjcmlwdD|PGltZyBzcmM9eCBvbmVycm9y|PGltZyBzcmM9eCBvbm|b25sb2FkPQ|b25lcnJvcj|b25jbGljaz|b25tb3VzZW92ZXI9|amF2YXNjcmlwdDo|PHN2Zy|PGJvZHkgb25sb2Fk|PGRldGFpbHMgb3Blbg|PGlmcmFtZSBzcmNkb2M)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 stored XSS via pointdata custom field on points_image post type save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14445-02": {"ajax_action": "devvn_ihotspot_clone_point", "conditions": [{"type": "missing_capability", "value": "edit_posts"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 missing authorization on devvn_ihotspot_clone_point AJAX handler allows authenticated users to clone hotspot posts", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14446-01": {"ajax_action": "easynotify_cp_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14446", "description": "Popup Builder (Easy Notify Lite) <=1.1.37 missing authorization on easynotify_cp_reset AJAX action allows authenticated Subscriber+ users to reset plugin settings", "mode": "block", "severity": 6.5, "slug": "easy-notify-lite", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2025-14448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)profile\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on profile.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)user-edit\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on user-edit.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14452-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "wpcr3_review"}, {"name": "ARGS:wpcr3_fname", "type": "regex", "value": "~(?:]|on(?:load|error|focus|click|mouseover|mouseout|keydown|keyup|change|submit|blur|dblclick|input|resize)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14452", "description": "WP Customer Reviews <=3.7.5 reflected XSS via wpcr3_fname parameter on admin review list", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-customer-reviews", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.7.5"}, "RULE-CVE-2025-14453-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*style_css\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14467-02": {"action": "init", "conditions": [{"name": "ARGS:wpjobportalme", "type": "equals", "value": "job"}, {"name": "ARGS:description", "type": "regex", "value": "~]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14477-01": {"ajax_action": "ajaxUpdatePaginationLinks", "conditions": [{"name": "ARGS:filterText", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:SELECT|DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|/\\\\*[^*]*\\\\*/\\\\s*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2025-14477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14477", "description": "404 Solution <=3.1.0 authenticated (Admin+) SQL injection via filterText parameter in ajaxUpdatePaginationLinks AJAX action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "404-solution", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-14506-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:post_content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14508-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mediacommander/v1/import-csv(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14508", "description": "MediaCommander <=2.3.1 missing authorization on import-csv REST endpoint allows Author+ to delete all media folder data", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mediacommander", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-1453-01": {"ajax_action": "save-widget", "conditions": [{"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (AJAX save-widget path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-1453-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/widgets\\\\.php~"}, {"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (classic widgets.php POST path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-14533-01": {"ajax_action": "nopriv_endpoint/form/shortcode", "conditions": [{"type": "missing_capability", "value": "promote_users"}, {"name": "ARGS", "type": "regex", "value": "~^(?:administrator|super_admin)$~"}], "cve": "CVE-2025-14533", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.1"}, "RULE-CVE-2025-14539-01": {"ajax_action": "shortcode_ajax", "conditions": [{"name": "ARGS:code", "type": "regex", "value": "~\\\\[[a-zA-Z_][^\\\\]]*\\\\]~"}], "cve": "CVE-2025-14539", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14539", "description": "Shortcode Ajax <=1.0 unauthenticated arbitrary shortcode execution via code parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcode-ajax", "tags": ["code-injection", "arbitrary-shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14548-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_title", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_title", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-1455-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget settings on Elementor REST save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-1455-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:_elementor_data", "type": "contains", "value": "wpr-woo-grid"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:popup_notification_animation|popup_notification_fade_out_in|popup_notification_animation_duration|element_open_links_in_new_tab)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\\\"|")(?:\\\\s)*(?:on[a-z]{3,20}\\\\s*=|>[^<]{0,200}<\\\\s*(?:script|svg|img|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget in _elementor_data on classic editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-14552-01": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-title", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-title in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14552-02": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-description", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-description in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14554-01": {"ajax_action": "orderform_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-z/!?]~i"}], "cve": "CVE-2025-14554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14554", "description": "Sell BTC - Cryptocurrency Selling Calculator <=1.5 unauthenticated stored XSS via orderform_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sell-btc-by-hayyatapps", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-14555-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdevart_countdown\\\\b[^\\\\]]*(?:]|[\'\\"]javascript\\\\s*:|on(?:error|load|click|mouseover|focus|mouse(?:over|out|enter|move))\\\\s*[=|]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1458", "description": "Element Pack Addons for Elementor <=5.10.29 Stored XSS via Elementor widget settings in post editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-addon"], "target": "plugin", "versions": "<=5.10.29"}, "RULE-CVE-2025-1459-01": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-02": {"ajax_action": "so_panels_builder_content_json", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content JSON preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-03": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|]*\\\\bon|]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in live editor preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-14610-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"csv_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via csv_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14610-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"json_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via json_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14627-01": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|\\\\[f[cd])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - direct internal/private IP in url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "internal-network-access"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14627-02": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://bit\\\\.ly/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - bit.ly redirect bypass to internal endpoints", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "redirect-bypass"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14632-01": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~\\\\.html?(?:[\\"\'\\\\s,}]|$)~i"}], "cve": "CVE-2025-14632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14632", "description": "Filr - Secure document library <=1.2.11 stored XSS via HTML file upload through chunked upload path (_chunkedd parameter)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "filr-protection", "tags": ["file-upload", "xss", "dangerous-file-type"], "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2025-14635-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:ha_page_custom_js", "type": "detectXSS"}], "cve": "CVE-2025-14635", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "target": "plugin", "versions": "<=3.20.3"}, "RULE-CVE-2025-14657-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v1/[^/]+/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14657", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "target": "plugin", "versions": "<=4.0.51"}, "RULE-CVE-2025-14718-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow creation REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow update REST endpoint", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow deletion REST endpoint", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+/publish(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow publish REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14720-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~refund~i"}, {"name": "ARGS", "type": "regex", "value": "~payment_id~i"}], "cve": "CVE-2025-14720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14720", "description": "Amelia Booking <=2.0 unauthenticated Square refund webhook forgery via missing signature verification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ameliabooking", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "webhook-forgery"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14732-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14732", "description": "Elementor <=3.35.5 stored XSS via REST API meta _elementor_data field", "mode": "block", "severity": 6.4, "slug": "elementor", "tags": ["stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.35.5"}, "RULE-CVE-2025-14745-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|]*/?\\\\s*>|]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized template parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-02": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:className", "type": "regex", "value": "~(?:[\\"\'][\\\\s>]|<[a-z]+[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized className parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-03": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:/^(?:source|sources|feeds|exclude|category|folders)$/", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|]*/?\\\\s*>|]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized source/sources/feeds/exclude/category/folders parameters in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-1475-01": {"ajax_action": "wpcom_login", "conditions": [{"name": "ARGS:user_phone", "type": "exists"}], "cve": "CVE-2025-1475", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "target": "plugin", "versions": "<=1.7.5"}, "RULE-CVE-2025-14757-01": {"ajax_action": "complete_payment", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14757", "description": "Cost Calculator Builder <=3.6.9 missing authorization on complete_payment AJAX action allows unauthenticated order status manipulation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-14793-01": {"action": "init", "conditions": [{"name": "ARGS:dkpdfg", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14793", "description": "DK PDF <=2.3.0 authenticated (Author+) SSRF via PDF generation trigger (dkpdfg parameter)", "method": "GET", "mode": "block", "severity": 5.0, "slug": "dk-pdf", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-14796-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "attachment"}, {"name": "ARGS:post_title", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core post.php attachment edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14796-02": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[title]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core save-attachment AJAX", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:tag-name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term creation (tag-name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14797-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editedtag"}, {"name": "ARGS:name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term edit (name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14799-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailin/v1/mailin_disconnect(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14799", "description": "Brevo (Mailin) <=3.3.0 unauthenticated authorization bypass via type juggling on mailin_disconnect REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mailin", "tags": ["authorization-bypass", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-14800-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/wpcf7r/v1/download-file(/|\\\\?|$)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)(wp-config\\\\.php|php\\\\.ini|\\\\.htaccess|\\\\.user\\\\.ini)(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)([^/]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx))(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(\\\\.\\\\./|\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|/etc/passwd|/windows/win\\\\.ini)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~^(https?|ftp)://[^\\\\s]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx)(\\\\?.*)?$~i"}], "cve": "CVE-2025-14800", "method": "GET", "mode": "block", "severity": 8.1, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-14803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_update_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|<|�*60;?|�*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14803-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_insert_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|<|�*60;?|�*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14804-01": {"ajax_action": "wpfm_delete_file", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_delete_file AJAX action (IDOR, no ownership check)", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "arbitrary-file-deletion", "idor"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14804-02": {"ajax_action": "wpfm_save_file_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_save_file_data path traversal in filename", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["path-traversal", "arbitrary-file-deletion", "file-name-manipulation"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14842-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:phar|svg)(?:\\\\s|$)~i"}], "cve": "CVE-2025-14842", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14842", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.2 \\u2013 best-effort block of .phar/.svg strings in POST/GET params on upload AJAX (NOTE: does not inspect multipart filenames in $_FILES; partial coverage only)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["dangerous-file-upload", "unauthenticated", "cwe-434", "partial-coverage"], "target": "plugin", "versions": "<=1.3.9.2"}, "RULE-CVE-2025-14844-01": {"ajax_action": "rcp_stripe_create_setup_intent_for_saved_card", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14844", "description": "Restrict Content <=3.2.16 unauthenticated Stripe SetupIntent client_secret leak via rcp_stripe_create_setup_intent_for_saved_card AJAX action (IDOR/Missing Auth)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authentication", "idor", "sensitive-data-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.2.16"}, "RULE-CVE-2025-14855-02": {"ajax_action": "validation_ajax_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|math|details|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer[a-z]*)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-14855", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14855", "description": "SureForms <=2.2.0 unauthenticated stored XSS via validation AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14865-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*headline\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode headline attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14865-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*acf\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script|\\"\\\\s+\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode acf attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14867-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via path traversal in post_content shortcode source attribute", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via REST API post creation with path traversal in content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14875-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "hblpay_return"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on wc-api callback", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-14875-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~hblpay-payment-gateway-for-woocommerce/return\\\\.php~"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on direct return.php access", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-1489-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-1489-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post_content param (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-14891-01": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:displayName", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14891", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14891", "description": "Customer Reviews for WooCommerce <=5.93.1 Stored XSS via displayName in cr_local_forms_submit AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.93.1"}, "RULE-CVE-2025-14893-01": {"action": "init", "conditions": [{"name": "ARGS:tel", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-14893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14893", "description": "IndieWeb <=4.0.5 Stored XSS via Telephone profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "indieweb", "tags": ["xss", "stored-xss", "user-profile"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-1490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smart-maintenance-mode"}, {"name": "ARGS:setstatus", "type": "detectXSS"}], "cve": "CVE-2025-1490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1490", "description": "Smart Maintenance Mode <=1.5.2 reflected XSS via setstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "smart-maintenance-mode", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-14948-01": {"ajax_action": "mo_wc_notification_enable", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:notification", "type": "exists"}], "cve": "CVE-2025-14948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14948", "description": "OTP Verification & SMS Notification <=4.3.8 missing authorization on mo_wc_notification_enable AJAX action allows unauthenticated notification settings toggle", "method": "POST", "mode": "block", "severity": 5.3, "slug": "miniorange-sms-order-notification-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2025-14973-01": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[0][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[0][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-02": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[1][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[1][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-03": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[2][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[2][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14975-02": {"action": "wp_loaded", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rp"}, {"name": "ARGS:pass1", "type": "exists"}, {"name": "ARGS:rp_key", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14975", "description": "Login Customizer <=2.5.3 unauthenticated arbitrary password reset via rp action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "login-customizer", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "password-reset"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-14976-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^user-registration~"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:post", "type": "regex", "value": "~^\\\\d+$~"}], "cve": "CVE-2025-14976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14976", "description": "User Registration & Membership <=4.4.8 CSRF to arbitrary post deletion via process_row_actions delete action", "method": "GET", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["csrf", "arbitrary-post-deletion", "missing-nonce"], "target": "plugin", "versions": "<=4.4.8"}, "RULE-CVE-2025-14977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to read other vendors\' store settings", "method": "GET", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to modify other vendors\' store settings including payment info", "method": "POST", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "account-takeover"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14983-01": {"ajax_action": "ACFFA_delete_icon_set", "conditions": [{"name": "ARGS:icon_set_name", "type": "regex", "value": "~<[^>]*(?:script|img|svg|iframe|object|embed|link|style|form|input|body|meta|marquee|details|math|isindex|base|area)|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseenter|mouseleave|mouseout|mousemove|dblclick|contextmenu|wheel|pointerover|animationend|toggle|resize|beforeunload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}], "cve": "CVE-2025-14983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14983", "description": "Advanced Custom Fields: Font Awesome <=5.0.1 Stored XSS via ACFFA_delete_icon_set icon_set_name parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-font-awesome", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2025-14985-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14985-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14997-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/members/.+/profile/edit/)~"}, {"name": "ARGS:/^field_\\\\d+$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 path traversal payload injection via xprofile field value during BuddyPress profile save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14997-02": {"ajax_action": "bpxcftr_remove_user_tag", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 missing authorization on bpxcftr_remove_user_tag AJAX action (defense-in-depth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14998-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:rp|resetpass)$~i"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-14998-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-activate\\\\.php~"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-15019-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:bialty_cs_alt", "type": "regex", "value": "~(?:]|]|on(?:error|load|mouseover|click|focus|blur|input|change|submit|keyup|keydown)\\\\s*=)~i"}], "cve": "CVE-2025-15019", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15019", "description": "BIALTY - Bulk Image Alt Text with Yoast SEO + WooCommerce <=2.2.1 authenticated stored XSS via bialty_cs_alt post meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bulk-image-alt-text-with-yoast", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15027-01": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_capabilities", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15027-02": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_user_level", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1503-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][name]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe Name field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-02": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][link]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe link field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][credit]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe credit field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-04": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][button]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe button field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-05": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][image_url]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe image_url field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-15030-01": {"action": "init", "conditions": [{"name": "ARGS:passw1", "type": "exists"}, {"name": "ARGS:passw2", "type": "exists"}, {"name": "ARGS:loginName", "type": "exists"}, {"name": "ARGS:key", "type": "exists"}, {"name": "ARGS:finalAction", "type": "equals", "value": "yes"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15030", "description": "Profile Builder <=3.15.1 unauthenticated account takeover via password reset bypass", "method": "POST", "mode": "block", "severity": 9.8, "slug": "profile-builder", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.15.1"}, "RULE-CVE-2025-15041-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/save_site_option(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15041", "method": "POST", "mode": "block", "severity": 7.2, "slug": "backwpup", "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2025-15057-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15057", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15057", "description": "SlimStat Analytics <=5.3.3 unauthenticated stored XSS via fh parameter in slimtrack AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2025-15058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pricing_table"}, {"name": "ARGS:table_currency", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15058", "description": "Responsive Pricing Table <=5.1.12 authenticated (Contributor+) Stored XSS via table_currency parameter in pricing_table CPT", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dk-pricr-responsive-pricing-table", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=5.1.12"}, "RULE-CVE-2025-1507-01": {"action": "init", "conditions": [{"name": "ARGS:ga_action", "type": "regex", "value": "~^ga_action_(auth|sharethis_invite|update_terms|enable_all_features|disable_all_features)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1507", "description": "ShareThis Dashboard for Google Analytics <=3.2.1 missing authorization on handle_actions() allows unauthenticated feature deactivation", "mode": "block", "severity": 5.3, "slug": "googleanalytics", "tags": ["missing-authorization", "unauthenticated", "feature-deactivation"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-15100-01": {"ajax_action": "jay_login_register_create_final_user", "conditions": [{"name": "ARGS:/(?i)^meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15100-03": {"ajax_action": "jay_panel_update_profile", "conditions": [{"name": "ARGS:/(?i)^jay_panel_meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1511-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ur-member~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1511", "description": "User Registration & Membership <=4.0.4 Reflected XSS via search parameter on membership admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1513-01": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Name", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Name field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-1513-02": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Comment", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Comment field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-15260-01": {"ajax_action": "lws_adminpanel_editlist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15260", "description": "MyRewards \\u2013 Loyalty Points and Rewards for WooCommerce <=5.6.0 missing authorization on lws_adminpanel_editlist allowing subscriber+ to modify loyalty rules", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woorewards", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2025-15266-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_frontendajax chat message", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-15266-02": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_ajax chat handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-1527-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Gutenberg REST API post update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "rest-api"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:save_builder|elementor_ajax)$~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "elementor"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-15283-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "exists"}, {"name": "ARGS:name_directory_name", "type": "regex", "value": "~(?:<|<?|�*60;?|�*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|>?|�*62;?|�*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|�*106;?avascript\\\\s*:|�*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "exists"}, {"name": "ARGS:name_directory_description", "type": "regex", "value": "~(?:<|<?|�*60;?|�*3[cC];?)(?:script|svg|iframe|body|marquee|object|embed|math)(?:[\\\\s/>]|>?|�*62;?|�*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|�*106;?avascript\\\\s*:|�*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_description parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-03": {"action": "init", "conditions": [{"name": "ARGS:name_directory_submitter", "type": "exists"}, {"name": "ARGS:name_directory_submitter", "type": "regex", "value": "~(?:<|<?|�*60;?|�*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|>?|�*62;?|�*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|�*106;?avascript\\\\s*:|�*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_submitter parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15285-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post modification via REST API", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post deletion via REST API", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-deletion"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/category(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated category creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15347-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15347", "method": "POST", "mode": "block", "severity": 8.8, "slug": "creatorlms", "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2025-15368-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15368-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15386-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with inline event handler in anchor tag", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with javascript URI in anchor href", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with inline event handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with javascript URI", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15396-01": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-error-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-error-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15396-02": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-success-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-success-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15403-01": {"ajax_action": "rm_user_exists", "conditions": [{"name": "ARGS:admin_order", "type": "exists"}], "cve": "CVE-2025-15403", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2025-15466-01": {"ajax_action": "delete_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-02": {"ajax_action": "clone_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on clone_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-03": {"ajax_action": "add_new_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_new_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-04": {"ajax_action": "save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-05": {"ajax_action": "get_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-06": {"ajax_action": "get_image_size_url", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_image_size_url AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-07": {"ajax_action": "delete_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-08": {"ajax_action": "save_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-09": {"ajax_action": "add_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-10": {"ajax_action": "sort_images", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on sort_images AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-11": {"ajax_action": "assign_filters", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_filters AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-12": {"ajax_action": "toggle_visibility", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on toggle_visibility AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-13": {"ajax_action": "assign_group", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_group AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-14": {"ajax_action": "update_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on update_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-15": {"ajax_action": "refresh_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on refresh_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-16": {"ajax_action": "save_video", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_video AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15477-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-post\\\\.php)~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15477-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15521-01": {"ajax_action": "academy/shortcode/password_reset_handler", "cve": "CVE-2025-15521", "method": "POST", "mode": "block", "severity": 9.8, "slug": "academy", "target": "plugin", "versions": "<=3.5.0"}, "RULE-CVE-2025-15522-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (post save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-15522-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-1560-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wee [^]]*(?:on[a-zA-Z]+=|javascript:|\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via floating-button settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "branding"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via branding settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "banner-settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via banner-settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1625-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1625-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1626-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1662-01": {"ajax_action": "url_media_uploader_url_upload", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:localhost|\\\\[?::1\\\\]?|0(?:\\\\.0){0,3}|127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0x[0-9a-f]{8}|[0-9]{8,10})(?:[:/]|$))~i"}], "cve": "CVE-2025-1662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1662", "description": "URL Media Uploader <=1.0.0 authenticated SSRF via url parameter in url_media_uploader_url_upload AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "url-media-uploader", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-1664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post create)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post update)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (classic editor post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "classic-editor"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1702-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~\'\\\\s*(?:OR|AND|UNION)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|--\\\\s*$|/\\\\*~i"}], "cve": "CVE-2025-1702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1702", "description": "Ultimate Member <=2.10.0 unauthenticated SQL injection via search parameter in member directory AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.10.0"}, "RULE-CVE-2025-1703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1703-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1717-01": {"action": "init", "conditions": [{"name": "ARGS:lmn", "type": "exists"}], "cve": "CVE-2025-1717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1717", "description": "Login Me Now <=1.7.2 unauthenticated authentication bypass via transient-based auto-login (lmn parameter)", "method": "GET", "mode": "block", "severity": 8.1, "slug": "login-me-now", "tags": ["authentication-bypass", "unauthenticated", "missing-authentication"], "target": "plugin", "versions": "<=1.7.2"}, "RULE-CVE-2025-1730-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~(?:(?:\\\\\\\\.\\\\\\\\.[\\\\\\\\\\\\/]){2,}|^/etc/|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) arbitrary file read via sdc_download post creation with malicious sdc_download_path", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "missing-authorization", "path-traversal"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-02": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~^(?:file://|php://|expect://|data://|glob://|phar://|ssh2://|ogg://|zlib://|rar://|zip://|ftp://|dict://|gopher://|ldap://|telnet://|smtp://|imap://|pop3://|http://(?:127\\\\.|0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|localhost|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) SSRF/arbitrary file read via sdc_download post creation with malicious remote URL", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "ssrf", "missing-authorization"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-03": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) capability bypass - non-admin creating sdc_download posts", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1766-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1766-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint (PATCH method)", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1768-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^sq_(ajax_)?(assistant|audits|bulkseo|focuspages|onboarding|post|saveseo)$~i"}, {"name": "ARGS:skeyword", "type": "regex", "value": "~\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+UNION(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(?:ALL(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+)?SELECT|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*[\\\\d(]|\'\\\\s*;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(IF|SLEEP|EXTRACTVALUE|BENCHMARK)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*\\\\(~i"}], "cve": "CVE-2025-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1768", "description": "Squirrly SEO <=12.4.05 authenticated blind SQL injection via skeyword parameter in AJAX search handlers", "method": "POST", "mode": "block", "severity": 6.5, "slug": "squirrly-seo", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=12.4.05"}, "RULE-CVE-2025-1783-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-02": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post partial update (PATCH)", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1784-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (post.php entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1784-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (REST API entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1785-01": {"ajax_action": "wpdm_newfile", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-1785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1785", "description": "Download Manager <=3.3.08 authenticated (Author+) path traversal via wpdm_newfile AJAX action allowing limited file overwrite", "method": "POST", "mode": "block", "severity": 8.1, "slug": "download-manager", "tags": ["path-traversal", "file-overwrite", "authenticated"], "target": "plugin", "versions": "<=3.3.08"}, "RULE-CVE-2025-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:$|[/?])~i"}, {"name": "ARGS:bb_social_login", "type": "equals", "value": "apple"}], "cve": "CVE-2025-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1909", "description": "BuddyBoss Platform Pro <=2.7.01 Apple OAuth authentication bypass (CWE-288) \\u2014 web flow wp-login.php?bb_social_login=apple", "method": "POST", "mode": "block", "severity": 9.8, "slug": "buddyboss-platform-pro", "target": "plugin", "versions": "<=2.7.01"}, "RULE-CVE-2025-1912-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wt_iew_export_download", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via export download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-02": {"action": "admin_init", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}, {"name": "ARGS:page", "type": "regex", "value": "~^wt-iew-(?:history|export)$~"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via history/export page download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-03": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:file_url", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via iew_import_ajax_basic validate_file", "method": "POST", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1971-01": {"ajax_action": "iew_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in export AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-1971-02": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in import AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-2004-01": {"ajax_action": "wpe_delete_file", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e[%2f/\\\\\\\\]|%252e%252e%252f)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2004", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2004", "description": "Simple WP Events <=1.8.17 unauthenticated arbitrary file deletion via wpe_delete_file AJAX action", "method": "POST", "mode": "block", "severity": 9.1, "slug": "simple-wp-events", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.8.17"}, "RULE-CVE-2025-2009-01": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber name field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2009-02": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber email field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2025-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:view", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2025-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:tab", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mappress_maps"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-zA-Z]+=|]|]|javascript\\\\s*:|]*\\\\bon[a-zA-Z]+=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2055", "description": "MapPress Maps for WordPress <=2.94.8 authenticated (Contributor+) stored XSS via map marker fields on admin page", "method": "POST", "mode": "block", "severity": 6.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.94.8"}, "RULE-CVE-2025-2056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via REQUEST_URI in showFile (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-03": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url parameter (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-04": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)~"}, {"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url targeting sensitive files", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2083-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in wp-admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2109-01": {"action": "init", "conditions": [{"name": "ARGS:css", "type": "regex", "value": "~^(?:https?://|//|ftp://|file://|php://|phar://|data://|expect://|glob://)~i"}], "cve": "CVE-2025-2109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2109", "description": "WP Compress <=6.30.15 unauthenticated SSRF via css query parameter in init hook", "mode": "block", "severity": 5.8, "slug": "wp-compress-image-optimizer", "tags": ["ssrf", "unauthenticated", "file-get-contents"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-01": {"ajax_action": "wps_ic_saveSetting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_saveSetting AJAX handler allows Subscriber+ to modify plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-02": {"ajax_action": "wps_ic_get_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_get_setting AJAX handler allows Subscriber+ to read plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-03": {"ajax_action": "wps_ic_settings_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_settings_change AJAX handler allows Subscriber+ to alter plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-04": {"ajax_action": "wpc_ic_checkCFConnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFConnect AJAX handler allows Subscriber+ to overwrite Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-05": {"ajax_action": "wpc_ic_checkCFDisconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFDisconnect AJAX handler allows Subscriber+ to delete Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-06": {"ajax_action": "wpc_ic_set_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_set_mode AJAX handler allows Subscriber+ to change plugin operation mode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-07": {"ajax_action": "wps_ic_purge_cdn", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_cdn AJAX handler allows Subscriber+ to purge CDN cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-08": {"ajax_action": "wps_ic_purge_html", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_html AJAX handler allows Subscriber+ to purge HTML cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-09": {"ajax_action": "wpc_ic_start_bulk_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_restore AJAX handler allows Subscriber+ to trigger bulk image restore", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-10": {"ajax_action": "wpc_ic_start_bulk_compress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_compress AJAX handler allows Subscriber+ to trigger bulk image compression", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-11": {"ajax_action": "wps_ic_save_excludes_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_save_excludes_settings AJAX handler allows Subscriber+ to modify exclude settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-12": {"ajax_action": "wps_lite_connect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_lite_connect AJAX handler allows Subscriber+ to connect plugin to external API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-13": {"ajax_action": "wps_ic_cname_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_cname_add AJAX handler allows Subscriber+ to add CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-14": {"ajax_action": "wps_ic_remove_cname", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_cname AJAX handler allows Subscriber+ to remove CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-15": {"ajax_action": "wps_ic_remove_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_key AJAX handler allows Subscriber+ to remove plugin API key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2111-02": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"name": "ARGS:page", "type": "equals", "value": "wpb-debug"}], "cve": "CVE-2025-2111", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2111", "description": "WP Headers And Footers <=3.1.1 CSRF to arbitrary options update via debug page POST request (set_option_name/option_value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-headers-and-footers", "tags": ["csrf", "arbitrary-option-update", "privilege-escalation"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-2128-01": {"ajax_action": "ccb_update_order", "conditions": [{"name": "ARGS:order_ids", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2128", "description": "Cost Calculator Builder <=3.2.67 authenticated SQL injection via order_ids parameter in Payments::update_payment_status_by_order_ids", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cost-calculator-builder", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=3.2.67"}, "RULE-CVE-2025-2162-01": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized width setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "settings-injection"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2162-02": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:base_font_size", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized base_font_size setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "style-breakout"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2164-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:sortby", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via sortby parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via post_id parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:pixelstats_page", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via pixelstats_page parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:last_day", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via last_day parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2166-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cm-faq($|-)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\'`]\\\\s*>\\\\s*<|<\\\\s*(?:script|svg|img|iframe|object|embed|body|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2166", "description": "CM FAQ <=1.2.5 Reflected XSS via remove_query_arg without esc_url on admin page URL", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cm-faq", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-2167-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[events_list\\\\b[^\\\\]]*(?:before_title|title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]+\\\\bontoggle\\\\s*=|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2167", "description": "Event Post <=5.9.9 Stored XSS via events_list shortcode attributes (before_title, title, after_title) in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "event-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2025-2186-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bwfan_get_automation_wc_dynamic_coupon"}, {"name": "ARGS:automationId", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2186", "description": "FunnelKit Automations <=3.5.1 unauthenticated SQL injection via automationId parameter in bwfan_get_automation_wc_dynamic_coupon AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-marketing-automations", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-2203-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/funnelkit-app/funnel-analytics/\\\\d+/contacts~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:\'[\\\\s)]*(?:UNION[\\\\s/\\\\*]+SELECT|OR[\\\\s/\\\\*]+[\'\\"]?\\\\w+[\'\\"]?\\\\s*[=<>]|AND[\\\\s/\\\\*]+[\'\\"]?\\\\w+|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)|INTO[\\\\s/\\\\*]+(?:OUT|DUMP)FILE|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE|UPDATEXML|LOAD_FILE))~i"}], "cve": "CVE-2025-2203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2203", "description": "FunnelKit Funnel Builder <=3.10.1 authenticated SQL injection via search parameter in funnel analytics contacts REST endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "funnel-builder", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2025-2221-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_login"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated time-based SQL injection via user_phone parameter in wpcom_login AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_register"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_register AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_send_sms_code"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_send_sms_code AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_lostpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_lostpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_resetpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_resetpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-06": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_accountbind"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_accountbind AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\"rael_title_tag\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<\\\\s*(?:script|img|svg|iframe|body|marquee|details|math|a\\\\b|div\\\\s|input)[^\\"]*|\\\\bon(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=)[^\\"]*\\"~i"}], "cve": "CVE-2025-2225", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2225", "description": "Responsive Addons for Elementor <=1.6.9 Stored XSS via rael_title_tag in Icon Box widget (post.php save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2025-2228-01": {"action": "init", "conditions": [{"name": "ARGS:rael-register-submit", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}, {"name": "ARGS:page_id", "type": "exists"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2025-2228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2228", "description": "Responsive Addons for Elementor <=1.6.8 sensitive information exposure via register_user \\u2014 blocks registration form submissions for users lacking create_users capability. NOTE: This also blocks anonymous self-registration on vulnerable versions as a protective measure.", "method": "POST", "mode": "block", "severity": 5.7, "slug": "responsive-addons-for-elementor", "tags": ["sensitive-information-exposure", "credential-leak"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-22295-01": {"ajax_action": "tripetto_submit", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated form submission (tripetto_submit snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22295-02": {"ajax_action": "tripetto_pause", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated paused form data (tripetto_pause snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22317-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpape-gallery-settings"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:onfocus|onload|onerror|onmouseover|onclick)\\\\s*=)~i"}], "cve": "CVE-2025-22317", "description": "Gallery Images Ape <=2.2.8 reflected XSS via tab parameter on admin settings page", "mode": "block", "severity": 7.1, "slug": "gallery-images-ape", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2025-22349-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:bid_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via bid_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-add"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-add admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-2252-01": {"ajax_action": "edd_get_download_title", "conditions": [{"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:action", "type": "equals", "value": "edd_get_download_title"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:edd_get_download_title", "type": "regex", "value": "~^[0-9]+$~"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7", "author_report.json:file-S6ZFTyHKyXhYs5pWZxQcgo"], "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2252", "mode": "block", "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.6.1"}, "RULE-CVE-2025-2257-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "boldgrid-backup-settings"}, {"name": "ARGS:compression_level", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2257", "description": "Total Upkeep \\u2013 BoldGrid Backup <=1.16.10 authenticated OS command injection via compression_level setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "boldgrid-backup", "tags": ["command-injection", "authenticated", "settings-update"], "target": "plugin", "versions": "<=1.16.10"}, "RULE-CVE-2025-2262-01": {"action": "template_include", "conditions": [{"name": "ARGS:gslogo_shortcode_preview", "type": "regex", "value": "~[\\\\[\\\\]\\"\'<>]~"}], "cve": "CVE-2025-2262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2262", "description": "GS Logo Slider <=3.7.3 unauthenticated arbitrary shortcode execution via gslogo_shortcode_preview parameter", "mode": "block", "severity": 7.3, "slug": "gs-logo-slider", "tags": ["missing-authorization", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2025-2269-01": {"ajax_action": "editimage_bwg", "conditions": [{"name": "ARGS:image_id", "type": "regex", "value": "~[<>\\"\'()]~"}], "cve": "CVE-2025-2269", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2269", "description": "Photo Gallery by 10Web <=1.8.34 reflected XSS via image_id in editimage_bwg AJAX handler", "mode": "block", "severity": 6.1, "slug": "photo-gallery", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.8.34"}, "RULE-CVE-2025-2270-01": {"action": "init", "conditions": [{"name": "ARGS:ycd_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data|expect|glob|ogg)://)~i"}], "cve": "CVE-2025-2270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2270", "description": "Countdown Builder <=2.8.9.1 unauthenticated Local File Inclusion via ycd_type parameter in RegisterPostType::createCdObj", "mode": "block", "severity": 8.1, "slug": "countdown-builder", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.8.9.1"}, "RULE-CVE-2025-22735-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via unsanitized $_SERVER[\'REQUEST_URI\'] in admin settings view templates", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~on(?:error|load|click|focus|mouseover|mouseout|submit|change|input|keydown|keyup)\\\\s*=~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via event handler injection in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:img|svg|iframe|body|embed|object|video|audio|details|math|marquee)[\\\\s/]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via HTML tag injection (img/svg/iframe/body/embed/object) in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22800-01": {"action": "admin_post_regenerate-qrcode", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "regenerate-qrcode"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-22800", "mode": "block", "severity": 8.8, "slug": "post-smtp", "target": "plugin", "versions": ">=2.8.3 <=2.9.11"}, "RULE-CVE-2025-2299-01": {"ajax_action": "lwptoc_block_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_edit AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2299-02": {"ajax_action": "lwptoc_block_view", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_view AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2302-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2314-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2314-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2317-01": {"ajax_action": "woo_product_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\'[) ]*(?:/[*][^*]*[*]/[ ]*)*(?:UNION(?:[ ]+|/[*][^*]*[*]/)(?:ALL(?:[ ]+|/[*][^*]*[*]/))?SELECT|(?:OR|AND)(?:[ ]+|/[*][^*]*[*]/)(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|[0-9]+[ ]*=[ ]*[0-9]))~i"}], "cve": "CVE-2025-2317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2317", "description": "Product Filter by WBW <=2.7.9 unauthenticated SQL injection via filtersDataBackend parameter in woo_product_filter AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woo-product-filter", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.7.9"}, "RULE-CVE-2025-2319-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_USER", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_USER parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:db_date", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in db_date parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_NAME", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_NAME parameter used in backup shell commands", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:Download_SQL_Backup", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|\\\\x0d|\\\\x0a)~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to path traversal and header injection via Download_SQL_Backup parameter", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "path-traversal", "header-injection"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_PASSWORD", "type": "regex", "value": "~[;`|\\\\x0a\\\\x0d]|\\\\$\\\\(~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell injection constructs in DB_PASSWORD parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_HOST", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_HOST parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2328-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+~"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary file deletion via path traversal in dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2328-02": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary sensitive file deletion via dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2330-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in _elementor_data (post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-2330-02": {"action": "init", "conditions": [{"name": "ARGS:elements", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in elements param (Elementor AJAX save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-23843-01": {"action": "init", "conditions": [{"name": "ARGS:filter_designation", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_designation parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-02": {"action": "init", "conditions": [{"name": "ARGS:filter_department", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_department parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-03": {"action": "init", "conditions": [{"name": "ARGS:filter_employment_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_employment_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-04": {"action": "init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via orderby parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-05": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via order parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-06": {"action": "init", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via status parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-07": {"action": "init", "conditions": [{"name": "ARGS:post_mime_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via post_mime_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-08": {"action": "init", "conditions": [{"name": "ARGS:detached", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via detached parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-09": {"action": "init", "conditions": [{"name": "ARGS:search_employee", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via search_employee parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-10": {"action": "init", "conditions": [{"name": "ARGS:from", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via from parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-11": {"action": "init", "conditions": [{"name": "ARGS:to", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via to parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-12": {"action": "init", "conditions": [{"name": "ARGS:filter_duration", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_duration parameter in audit log", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23942-01": {"ajax_action": "wpgallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wpgallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-02": {"ajax_action": "wplg_edit_gallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wplg_edit_gallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-03": {"ajax_action": "wplg_loadmore_gallery", "conditions": [{"name": "ARGS:options", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via options parameter in wplg_loadmore_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-04": {"ajax_action": "wplg_navigation_gallery", "conditions": [{"name": "ARGS:gallery_id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via gallery_id parameter in wplg_navigation_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-24000-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/post-smtp/v1/logs/[^/]+/resend(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 post-smtp/v1/logs/{id}/resend REST endpoint callable by non-admin users, allowing abuse of password reset emails.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs", "resend"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/email-count(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/email-count REST endpoint accessible to non-admin users.", "method": "GET", "mode": "block", "severity": 6.5, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/minimize-maximize-ad(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/minimize-maximize-ad REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/get-failed-logs(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/get-failed-logs REST endpoint accessible to non-admin users, exposing failed email log contents.", "method": "GET", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/open-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/open-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/remove-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/remove-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24563-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:user_name_search", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via user_name_search parameter in author-search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-04": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-05": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-06": {"action": "template_redirect", "conditions": [{"name": "ARGS:dir_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via dir_id parameter in claim.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-07": {"action": "template_redirect", "conditions": [{"name": "ARGS:package_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via package_id parameter in wizard-style-2.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24573-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur|change|input|submit|keydown|keyup|pointerover|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-24573", "description": "PageLayer <=1.9.4 contributor+ stored XSS via pagelayer_save_content AJAX handler", "mode": "block", "severity": 6.5, "slug": "pagelayer", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2025-24587-01": {"ajax_action": "getEmailTemplate", "conditions": [{"name": "ARGS:entrant", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,.*,|CASE\\\\s+WHEN\\\\s+.*\\\\s+THEN\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24587", "description": "Email Subscription Popup <=1.2.23 authenticated blind SQL injection via entrant parameter in getEmailTemplate AJAX handler", "mode": "block", "severity": 7.6, "slug": "email-subscribe", "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-24601-01": {"action": "init", "conditions": [{"name": "ARGS:dn-listener", "type": "equals", "value": "paypal"}, {"name": "ARGS:custom", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-24601", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24601", "description": "FundPress <=2.0.6 unauthenticated PHP object injection via PayPal IPN custom parameter", "mode": "block", "severity": 9.8, "slug": "fundpress", "tags": ["object-injection", "deserialization", "unauthenticated", "paypal-ipn"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-24648-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:login_redirect_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 privilege escalation via login_redirect_url in profile update", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-02": {"ajax_action": "save_custom_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-03": {"ajax_action": "save_custom_menu_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_menu_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-04": {"ajax_action": "save_hidden_menu_items", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_hidden_menu_items AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24677-01": {"ajax_action": "pp_wpspin_import_json", "conditions": [{"name": "FILES:pp_wpspin_import_json_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 authenticated remote code execution via arbitrary file write in pp_wpspin_import_json AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["remote-code-execution", "arbitrary-file-write", "code-injection"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24677-02": {"ajax_action": "pp_wpspin_export_json", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 missing authorization on pp_wpspin_export_json allows authenticated users to export arbitrary posts via IDOR", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24752-01": {"action": "init", "conditions": [{"name": "ARGS:popup-selector", "type": "regex", "value": "~[<>\\"\'(){}]|javascript\\\\s*:|on(?:error|load|focus|click|mouseover|mouseout|keyup|keydown|submit|change|input|blur)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|body|details|marquee|video|audio|form|math|base)~i"}], "cve": "CVE-2025-24752", "method": "GET", "mode": "block", "severity": 6.1, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.14"}, "RULE-CVE-2025-24753-01": {"ajax_action": "kadence_import_get_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-02": {"ajax_action": "kadence_import_reload_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-03": {"ajax_action": "kadence_import_get_new_connection_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-04": {"ajax_action": "kadence_import_get_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-05": {"ajax_action": "kadence_import_reload_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-06": {"ajax_action": "kadence_import_get_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-07": {"ajax_action": "kadence_import_reload_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-08": {"ajax_action": "kadence_import_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-09": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-10": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-11": {"ajax_action": "kadence_subscribe_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-2478-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-edit"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 time-based blind SQL injection via snippetId on snippet-edit admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2478-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-delete"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 SQL injection via snippetId on snippet-delete admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2481-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mediaview"}, {"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2025-2481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2481", "description": "MediaView <=1.1.2 Reflected Cross-Site Scripting via id parameter on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mediaview", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2484-01": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:video_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via video_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-02": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:group_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via group_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-03": {"ajax_action": "mvob_add_videos_to_groups", "conditions": [{"name": "ARGS:add_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via add_videos in mvob_add_videos_to_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-04": {"ajax_action": "mvob_remove_videos_from_groups", "conditions": [{"name": "ARGS:remove_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via remove_videos in mvob_remove_videos_from_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2537-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nggallery-manage-gallery"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form|svg|math)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-2537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2537", "description": "NextGEN Gallery <=3.59.11 Stored DOM-Based XSS via image metadata in manage gallery page", "method": "POST", "mode": "block", "severity": 6.4, "slug": "nextgen-gallery", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.59.11"}, "RULE-CVE-2025-2540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2540-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|products?)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto", "rest-api"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2543-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/async-upload\\\\.php|/wp-admin/upload\\\\.php)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:svg|svgz)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through async-upload.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2543-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?|)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through REST media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "rest-api"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2563-01": {"ajax_action": "user_registration_user_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-2563", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-2576-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress media uploader (admin-ajax.php upload-attachment)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2576-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/async-upload\\\\.php(?:\\\\?|$)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress async-upload.php endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2579-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/async-upload.php"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:json|lottie)$~i"}], "cve": "CVE-2025-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2579", "description": "Lottie Player <=1.1.8 Stored XSS via malicious .json/.lottie file upload through async-upload.php (blocks uploads matching patch behavior of 1.2.0)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-lottie-player", "tags": ["xss", "stored-xss", "file-upload", "authenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-2580-01": {"ajax_action": "bitforms_submit_form", "conditions": [{"name": "ARGS:attachment_name", "type": "regex", "value": "~\\\\.svg(?:$|[\\\\s\\"\'&?#])~i"}], "cve": "CVE-2025-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2580", "description": "Bit Form <= 2.18.3 Stored XSS via SVG file upload through bitforms_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bit-form", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=2.18.3"}, "RULE-CVE-2025-2594-01": {"ajax_action": "user_registration_membership_confirm_payment", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"name": "ARGS:auto_login", "type": "regex", "value": "~^(?:true|1|yes|on)$~i"}], "cve": "CVE-2025-2594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2594", "description": "User Registration & Membership <=4.1.2 authentication bypass via membership_confirm_payment AJAX action with auto_login parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["authentication-bypass", "idor", "unauthenticated", "account-takeover"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-2635-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-activations"}, {"name": "ARGS:license-id", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped license-id parameter on Activations admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2635-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-licenses"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped search parameter on Licenses admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2636-01": {"action": "init", "conditions": [{"name": "ARGS:instawp-database-manager", "type": "exists"}, {"name": "ARGS:instawp-database-manager", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|php://|data://|expect://|zip://|phar://)~i"}], "cve": "CVE-2025-2636", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.85"}, "RULE-CVE-2025-26592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26592-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26763-04": {"ajax_action": "ms_import_others", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^ms_import_others$~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-26763", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-26763", "description": "MetaSlider <=3.94.0 PHP Object Injection via ms_import_others AJAX handler", "mode": "block", "severity": 9.8, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.94.0"}, "RULE-CVE-2025-2685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "tablepress"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:table-name", "type": "detectXSS"}], "cve": "CVE-2025-2685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2685", "description": "TablePress <=3.0.4 Authenticated (Author+) Stored XSS via table-name parameter on admin form POST", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-27007-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sure-triggers/v1/automation/action(/|\\\\?|&|$)~"}, {"name": "ARGS:type_event", "type": "equals", "value": "create_user_if_not_exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-27007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.0.82"}, "RULE-CVE-2025-27012-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with users_can_register option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-27012-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with default_role option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-2719-01": {"ajax_action": "swatchly_notices", "conditions": [{"name": "ARGS:noticeid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2719", "description": "Swatchly <=1.4.0 missing authorization on swatchly_notices AJAX action allows Subscriber+ to update arbitrary options to true", "method": "POST", "mode": "block", "severity": 6.5, "slug": "swatchly", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-2779-01": {"ajax_action": "htscript_notices", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on htscript_notices AJAX action allows arbitrary option update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2779-02": {"ajax_action": "ihafs_diagnostic_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on ihafs_diagnostic_data AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2800-01": {"ajax_action": "add_organizer", "conditions": [{"name": "ARGS:organizer_name", "type": "detectXSS"}], "cve": "CVE-2025-2800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2800", "description": "WP Event Manager <=3.1.50 unauthenticated stored XSS via organizer_name in add_organizer AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-event-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.50"}, "RULE-CVE-2025-2801-01": {"ajax_action": "abcsubmit_form_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[.+\\\\]~s"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2801", "description": "ABCSubmit <=1.2.3 unauthenticated arbitrary shortcode execution via abcsubmit_form_preview AJAX handler", "method": "POST", "mode": "block", "severity": 7.3, "slug": "abcsubmit", "tags": ["code-injection", "arbitrary-shortcode", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-2805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~[[][a-z][a-z0-9_-]{2,} [^]]*=[^]]*[]]~"}], "cve": "CVE-2025-2805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2805", "description": "ORDER POST <=2.0.2 unauthenticated arbitrary shortcode execution via comment text containing shortcode syntax", "method": "POST", "mode": "block", "severity": 7.3, "slug": "order-post", "tags": ["code-injection", "shortcode-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-2807-01": {"ajax_action": "mvl_setup_wizard_install_plugin", "conditions": [{"name": "ARGS:plugin", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-2807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2807", "description": "Motors - Car Dealership & Classified Listings <= 1.4.64 missing authorization on mvl_setup_wizard_install_plugin allowing Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.64"}, "RULE-CVE-2025-2816-01": {"ajax_action": "pvc_yellow_message_dontshow", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2816", "description": "Page View Count <=2.8.4 missing authorization on pvc_yellow_message_dontshow AJAX handler allows arbitrary option update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "page-views-count", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=2.8.4"}, "RULE-CVE-2025-2821-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings modification endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2821-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings read endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2839-01": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-02": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-03": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-04": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 script tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-05": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-06": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2889-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_type", "type": "equals", "value": "link_library_links"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on[a-zA-Z0-9_]+ *=|xmlns|style *=[ ]*[\\"\'][^\\"\']*(?:expression|url) *\\\\()|< *(?:script|iframe|object|embed|form|svg|math|base|link|meta)|javascript *:|data *: *text/html~i"}], "cve": "CVE-2025-2889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2889", "description": "Link Library <=7.7.3 Authenticated (Contributor+) Stored XSS via Link Additional Parameters on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "link-library", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.7.3"}, "RULE-CVE-2025-2893-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in classic editor post submission", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-28983-01": {"ajax_action": "CNPCF_cnpgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-02": {"ajax_action": "CNPCF_friendlyname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_friendlyname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-03": {"ajax_action": "CNPCF_cnpaccountid", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpaccountid AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-04": {"ajax_action": "CNPCF_cnpchnlgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpchnlgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-05": {"ajax_action": "getCnPUserChannelList", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on getCnPUserChannelList AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-2940-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "contains", "value": "wpf-async-request-"}, {"name": "ARGS:args[url]", "type": "exists"}], "cve": "CVE-2025-2940", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2940", "description": "Ninja Tables <= 5.0.18 unauthenticated SSRF via WPFluent async request handler args[url] parameter", "mode": "block", "severity": 7.2, "slug": "ninja-tables", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=5.0.18"}, "RULE-CVE-2025-2941-01": {"ajax_action": "dnd_codedropz_upload_wc", "conditions": [{"name": "FILES:wc-upload-file[]", "type": "exists"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-2941-02": {"ajax_action": "dnd_codedropz_upload_delete_wc", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.)|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[\\\\\\\\/]))~i"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-3058-01": {"ajax_action": "xwc_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:settings", "type": "exists"}], "cve": "CVE-2025-3058", "method": "POST", "mode": "block", "severity": 8.8, "slug": "xelion-webchat", "target": "plugin", "versions": "<=9.1.0"}, "RULE-CVE-2025-3064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on options.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/network/settings.php"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on network settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wpfront-secondary-roles[administrator]", "type": "exists"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via secondary roles including administrator", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3075-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\bon(?:mouse(?:over|enter|move|out|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|animate(?:end|start|iteration)|transition(?:end|run|start)|pointer(?:over|enter|down|up|move|out)|touch(?:start|end|move))\\\\s*=~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-3075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3075", "description": "Elementor <=3.29.0 Authenticated (Contributor+) Stored XSS via widget settings in elementor_ajax save handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementor", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=3.29.0"}, "RULE-CVE-2025-30772-01": {"ajax_action": "wpcuf_import_export_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 arbitrary option update to privilege escalation via wpcuf_import_export_save AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30772-02": {"ajax_action": "wpcuf_import_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 missing authorization on wpcuf_import_export AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30773-01": {"ajax_action": "trp_save_translations_regular", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_regular strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-02": {"ajax_action": "trp_save_translations_gettext", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_gettext strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-03": {"ajax_action": "trp_update_database", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_update_database AJAX handler", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30911-01": {"ajax_action": "install_requirements", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on install_requirements allows subscriber+ arbitrary plugin installation leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-plugin-install", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-30911-02": {"ajax_action": "import_rtm_template", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on import_rtm_template allows subscriber+ arbitrary file write leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-file-write", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-31019-01": {"action": "init", "conditions": [{"name": "ARGS:mopppm_userid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31019", "method": "POST", "mode": "block", "severity": 8.8, "slug": "password-policy-manager", "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-3102-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:sure-triggers|suretriggers|ottokit)/v1/(?:authenticate-user|automation/action)(?:/|\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:st_authorization", "type": "regex", "value": "~^(?:[\\\\s]*|Bearer[\\\\s]*)$~i"}], "cve": "CVE-2025-3102", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3102", "description": "SureTriggers <=1.0.78 unauthenticated REST API authentication bypass via empty st_authorization header", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.78"}, "RULE-CVE-2025-3106-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"action\\"\\\\s*:\\\\s*\\"save_builder\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"lakit-table-of-contents\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:\\"icon\\"\\\\s*:\\\\s*\\\\{[^{}\\\\r\\\\n]{0,1024}\\"value\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\\\\\r\\\\n]{0,256}(?:\\\\\\\\\\"|\\\\\\\\u0022)[^\\"\\\\r\\\\n]{0,128}\\\\bon[a-z][a-z0-9_:-]*\\\\s*=|&(?:lt|\\\\#0*60|\\\\#x0*3c);\\\\s*(?:script(?=\\\\s|&(?:gt|\\\\#0*62|\\\\#x0*3e);)|(?:img|svg|iframe|object|embed|details|math|video|audio|body)\\\\b[^\\\\r\\\\n]{0,512}?\\\\bon[a-z][a-z0-9_:-]*\\\\s*=))~ix"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3106", "description": "LA-Studio Element Kit for Elementor <=1.4.9 authenticated stored XSS via unsanitized Table of Contents list text or icon value in Elementor save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2025-3107-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in post_content (classic editor POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PUT)", "method": "PUT", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-31560-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "salon-customers"}, {"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02A": {"ajax_action": "salon", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02B": {"ajax_action": "salon", "conditions": [{"name": "ARGS:user_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-32118-01": {"ajax_action": "cmp_ajax_upload_font", "conditions": [{"name": "FILES:font_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-32118", "description": "CMP Coming Soon & Maintenance <=4.1.14 authenticated arbitrary file upload via cmp_ajax_upload_font", "mode": "block", "severity": 9.1, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=4.1.14"}, "RULE-CVE-2025-32143-01": {"ajax_action": "accordions_ajax_import_json", "conditions": [{"name": "ARGS:accordions_data", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-32143", "description": "Accordion <=2.3.11 PHP object injection via accordions_data parameter in import handler", "mode": "block", "severity": 8.8, "slug": "accordions", "target": "plugin", "versions": "<=2.3.11"}, "RULE-CVE-2025-32486-01": {"ajax_action": "public_amd_ajax_handler", "conditions": [{"name": "ARGS:reset_password[new_password]", "type": "exists"}, {"name": "ARGS:reset_password[vcode]", "type": "regex", "value": "~^0[eE]\\\\d+$~"}], "cve": "CVE-2025-32486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "material-dashboard", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2025-32568-01": {"ajax_action": "empik_csv_process_emp_log_classes", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_log_classes AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32568-02": {"ajax_action": "empik_csv_process_emp_prod_states", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_prod_states AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32597-01": {"ajax_action": "cdaily", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^A-Za-z0-9_.$]~"}], "cve": "CVE-2025-32597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32597", "description": "Connect Daily Web Calendar <=1.5.4 reflected XSS via unsanitized JSONP callback parameter in cdaily AJAX handler", "mode": "block", "severity": 7.1, "slug": "connect-daily-web-calendar", "tags": ["xss", "csrf", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-32648-01": {"ajax_action": "pto_ajax_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-32648", "method": "POST", "mode": "block", "severity": 9.8, "slug": "projectopia-core", "target": "plugin", "versions": "<=5.1.23"}, "RULE-CVE-2025-32652-01": {"ajax_action": "solace_extra_upload_logo", "conditions": [{"name": "ARGS:logo_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[?#%/]|$)|\\\\.htaccess(?:[?#%/]|$)|\\\\.htpasswd(?:[?#%/]|$)~i"}], "cve": "CVE-2025-32652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32652", "description": "Solace Extra <=1.3.1 arbitrary file upload via solace_extra_upload_logo AJAX handler allowing remote PHP file write", "mode": "block", "severity": 9.9, "slug": "solace-extra", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-32682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapsvg/v[0-9]+/~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-32682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32682", "description": "MapSVG Lite <=8.6.4 authenticated (Contributor+) arbitrary file upload via REST API allowing web shell deployment", "method": "POST", "mode": "block", "severity": 9.9, "slug": "mapsvg-lite-interactive-vector-maps", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "authenticated"], "target": "plugin", "versions": "<=8.6.4"}, "RULE-CVE-2025-3281-01": {"ajax_action": "user_registration_membership_create_stripe_subscription", "conditions": [{"name": "ARGS:member_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 IDOR in create_stripe_subscription allowing unauthenticated user deletion via member_id", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "missing-authorization", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-03": {"ajax_action": "user_registration_membership_verify_pages", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on verify_pages membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-04": {"ajax_action": "user_registration_membership_validate_pg", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on validate_pg membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3418-01": {"ajax_action": "wpcac_edit_save", "conditions": [{"name": "ARGS:field", "type": "regex", "value": "~^(wp_capabilities|wp_user_level|role)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3418", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-admin-columns", "target": "plugin", "versions": ">=2.0.6 <=2.1.0"}, "RULE-CVE-2025-3421-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "evf-entries"}, {"name": "ARGS:form_id", "type": "regex", "value": "~(?:]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\'\\"]?javascript))~i"}], "cve": "CVE-2025-3421", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3421", "description": "Everest Forms <=3.1.1 Reflected Cross-Site Scripting via form_id parameter on admin entries page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "everest-forms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3422-01": {"ajax_action": "everest_forms_form_preview_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3422", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3422", "description": "Everest Forms <=3.1.1 authenticated arbitrary shortcode execution via form_preview_save AJAX action", "method": "POST", "mode": "block", "severity": 6.3, "slug": "everest-forms", "tags": ["missing-authorization", "arbitrary-shortcode-execution", "code-injection"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3428-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3428-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<|�*60;|�*3c;)\\\\s*script\\\\b|\\\\bon[a-zA-Z0-9_]+\\\\s*=|]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_header parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3435-02": {"ajax_action": "mb_board", "conditions": [{"name": "ARGS:board_footer", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_footer parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3436-01": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via orderby parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3436-02": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via order parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3438-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/(?:register|sign_up|sign_up_2)(/|\\\\?|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!(subscriber|customer|owner|driver)$).+$~"}], "cve": "CVE-2025-3438", "method": "POST", "mode": "block", "severity": 7.3, "slug": "mstore-api", "target": "plugin", "versions": "<4.17.5"}, "RULE-CVE-2025-3439-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3439-02": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3455-01": {"action": "admin_post_start_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated arbitrary file upload via start_restore admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["arbitrary-file-upload", "missing-authorization", "file-upload"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-02": {"action": "admin_post_start_backup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on start_backup admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-03": {"action": "admin_post_cancel_actions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on cancel_actions admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3457-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3457-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:ocean_gallery_id[/[0-9]+/]", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-3458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3458", "description": "Ocean Extra <=2.4.6 stored XSS via unsanitized ocean_gallery_id in gallery metabox", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3468-01": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~]*>|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-02": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-03": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~]*>|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-04": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3471-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sureforms/v1/global-settings(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3471", "description": "SureForms <1.4.4 incorrect authorization on global-settings REST API endpoint allows Contributor+ to update plugin settings", "method": "POST", "mode": "block", "severity": 4.9, "slug": "sureforms", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<1.4.4"}, "RULE-CVE-2025-3487-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[forminator_form[^\\\\]]*\\\\blimit\\\\s*=\\\\s*([\\"\'])[\\\\s\\\\S]*?(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}\\\\s*=|javascript\\\\s*:|&#\\\\d+;|&#x[0-9a-fA-F]+;)[\\\\s\\\\S]*?\\\\1~i"}], "cve": "CVE-2025-3487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3487", "description": "Forminator <=1.42.0 Stored XSS via limit parameter in forminator_list_pagination", "mode": "block", "severity": 5.4, "slug": "forminator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.42.0"}, "RULE-CVE-2025-3515-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "dnd_codedropz_upload"}, {"name": "FILES", "type": "exists"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:phar|pht|phtml|php[0-9]?|phps|php\\\\.[^./]+|inc)$~i"}], "cve": "CVE-2025-3515", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "target": "plugin", "versions": "<=1.3.8.9"}, "RULE-CVE-2025-3516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via post_content attribute injection (classic editor)", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3516-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via REST API post content attribute injection", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3520-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on profile.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3520-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on user-edit.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3597-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in post_content on classic editor", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "post-content"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3597-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in content on REST API posts endpoint", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3614-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript[ ]*:|&#[xX]?[0-9a-fA-F]+;?[a-zA-Z]*script[ ]*:|data[ ]*:[ ]*text/html|on(?:mouse(?:over|enter|move|out|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|dblclick|drag|drop|resize|scroll|unload|beforeunload|pointerover|pointerenter|animationend|transitionend)[ ]*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3614", "description": "ElementsKit Elementor Addons <=3.5.2 Stored XSS via Widget Builder URL control through ekit_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "widget-builder"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-3616-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v1/proxy-api(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-3616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3616", "description": "GreenShift Animation and Page Builder Blocks >=11.4 <=11.4.5 authenticated arbitrary file upload via REST proxy-api endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["arbitrary-file-upload", "missing-authorization", "rest-api", "file-upload"], "target": "plugin", "versions": ">=11.4 <=11.4.5"}, "RULE-CVE-2025-3649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:�*58;?|�*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:�*58;?|�*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:�*58;?|�*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3662-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 unauthenticated stored XSS via comment submission with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3662-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 Contributor+ stored XSS via post content with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3703-01": {"ajax_action": "cjtoolbox_get_info_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) local file inclusion via cjtoolbox_get_info_view AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_create AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-03": {"ajax_action": "cjtoolbox_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_delete AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-04": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_set_property AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-05": {"ajax_action": "cjtoolbox_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_restore AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-06": {"ajax_action": "cjtoolbox_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_list AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-07": {"ajax_action": "cjtoolbox_get_revision", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revision AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-08": {"ajax_action": "cjtoolbox_get_revisions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revisions AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3752-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3752-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3761-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(profile|user-edit)\\\\.php~"}, {"name": "ARGS:mt_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3761", "description": "My Tickets <= 2.0.16 authenticated privilege escalation via mt_capabilities in profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "my-tickets", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.16"}, "RULE-CVE-2025-3775-01": {"ajax_action": "woolentor_proxy_image", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?!library\\\\.shoplentor\\\\.com(:[0-9]+)?(/|$|\\\\?))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3775", "description": "ShopLentor (WooLentor) <=3.1.2 unauthenticated SSRF via woolentor_proxy_image AJAX endpoint \\u2014 blocks requests where the url parameter targets any host other than the legitimate library.shoplentor.com", "mode": "block", "severity": 6.5, "slug": "woolentor-addons", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-3780-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wcfm-setup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3780", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3780", "description": "WCFM Frontend Manager <=6.7.16 unauthenticated plugin settings modification via admin_init setup redirect", "mode": "block", "severity": 6.5, "slug": "wc-frontend-manager", "tags": ["missing-authorization", "unauthenticated", "settings-tampering"], "target": "plugin", "versions": "<=6.7.16"}, "RULE-CVE-2025-3781-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3781-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in REST API post content", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3782-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3782-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3809-01": {"ajax_action": "log_js_errors", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~(?i)(<\\\\s*script\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3809", "description": "Debug Log Manager <=2.3.4 unauthenticated stored XSS via log_js_errors AJAX error parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "debug-log-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2025-3858-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3858-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3860-01": {"ajax_action": "sc_ajax_handler", "conditions": [{"name": "ARGS:saleclass", "type": "exists"}, {"name": "ARGS:saleclass", "type": "regex", "value": "~[<>\\"\']~"}], "cve": "CVE-2025-3860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3860", "description": "CarDealerPress <=6.8.2505.00 Stored XSS via saleclass parameter in sc_ajax_handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cardealerpress", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.8.2505.00"}, "RULE-CVE-2025-3861-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/un-protect-files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API un-protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API file protection status endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/private-urls/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API private URLs endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3862-01": {"action": "init", "conditions": [{"name": "ARGS:cg_off_id", "type": "regex", "value": "~[<>\\"\'();]~"}], "cve": "CVE-2025-3862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3862", "description": "Contest Gallery <= 26.0.6 Stored XSS via cg_off_id parameter in shortcode rendering", "mode": "block", "severity": 5.4, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=26.0.6"}, "RULE-CVE-2025-3868-01": {"action": "admin_init", "conditions": [{"name": "ARGS:menuObject", "type": "detectXSS"}], "cve": "CVE-2025-3868", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3868", "description": "Custom Admin-Bar Favorites <=0.1 reflected XSS via menuObject parameter", "mode": "block", "severity": 6.1, "slug": "admin-bookmarks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-3876-01": {"action": "init", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "smsalert_ajax_form_validate"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3876", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sms-alert", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2025-3878-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[sa_verify\\\\s[^\\\\]]*(?:phone_selector|submit_selector|user_selector|pwd_selector|placeholder)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*\\\\)|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-39590", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39590", "description": "Essential Addons for Elementor <=6.1.9 contributor+ stored XSS via Advanced Tabs tab_title widget setting", "mode": "block", "severity": 6.5, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.9"}, "RULE-CVE-2025-39596-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (GET)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-39596-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (POST)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-4054-02": {"action": "init", "conditions": [{"name": "ARGS:highlight", "type": "regex", "value": "~(?:]|]+onerror\\\\s*=|]+onload\\\\s*=|]+src\\\\s*=\\\\s*[\\"\']?javascript:|]+onload\\\\s*=|]+ontoggle\\\\s*=|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=)~i"}], "cve": "CVE-2025-4054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4054", "description": "Relevanssi <=4.24.3 unauthenticated reflected XSS via highlight query parameter", "mode": "block", "severity": 6.1, "slug": "relevanssi", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.24.3"}, "RULE-CVE-2025-4099-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4099-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in post_content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4104-01": {"ajax_action": "fed_login_form_post", "conditions": [{"name": "ARGS:submit", "type": "equals", "value": "register"}, {"name": "ARGS:ID", "type": "exists"}], "cve": "CVE-2025-4104", "method": "POST", "mode": "block", "severity": 9.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.6"}, "RULE-CVE-2025-4127-01": {"ajax_action": "kcSeoMainSettings_action", "conditions": [{"name": "ARGS:site_price_range", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4127", "description": "WP SEO Structured Data Schema <=2.7.11 Stored XSS via site_price_range parameter in kcSeoMainSettings_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-seo-structured-data-schema", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-4131-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode attributes in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode event handler in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4133-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_title", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 stored XSS via unescaped post title in plugin dashboard views", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-ship"}, {"name": "ARGS:postId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via postId parameter on ship page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByDate", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByDate on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sUserAuthId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sUserAuthId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sPostBlogId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sPostBlogId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByNetwork", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByNetwork on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4169-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ppc\\\\b[^\\\\]]*(?:moretxt|title)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]+\\\\bon\\\\w+\\\\s*=|]*\\\\bon\\\\w+\\\\s*=|]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=abundatrade)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4188-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "reorder-simple-image-text-slider-setting"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|svg|img|object|embed|form|details|math)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=reorder-simple-image-text-slider-setting)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4203-01": {"action": "init", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-02": {"action": "init", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-03": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-04": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-05": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-06": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4206-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "import_delete"}, {"name": "ARGS:import", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_import_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4206-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "export_delete"}, {"name": "ARGS:export", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_export_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4208-01": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS:header_params", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in flat header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4208-02": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in array-encoded header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4212-01": {"ajax_action": "alg_ajax_file_upload", "conditions": [{"name": "ARGS:alg_checkout_files_upload_uploader", "type": "exists"}], "cve": "CVE-2025-4212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4212", "description": "Checkout Files Upload for WooCommerce <=2.2.1 unauthenticated stored XSS via uploaded filename in alg_ajax_file_upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "checkout-files-upload-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-4223-01": {"ajax_action": "pagelayer_login_submit", "conditions": [{"name": "ARGS:login_url", "type": "regex", "value": "~(?:]|on(?:error|load|unload|mouseover|mouseout|mousedown|mouseup|mousemove|click|dblclick|focus|blur|change|submit|reset|select|keydown|keyup|keypress|input|beforeunload|resize|scroll|contextmenu|drag|drop|copy|cut|paste|abort|cancel|invalid|toggle|wheel|pointerdown|pointerup|pointermove|pointerover|pointerout|pointercancel)\\\\s*=|javascript\\\\s*:|data:[a-zA-Z+][a-zA-Z0-9+./-]*(?:;[^,]*)?,|vbscript\\\\s*:|%3Cscript|%253Cscript|javascript%3A|%6A%61%76%61%73%63%72%69%70%74)~i"}], "cve": "CVE-2025-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4223", "description": "Pagelayer <=2.0.0 reflected XSS via login_url parameter in pagelayer_login_submit AJAX handler", "mode": "block", "severity": 4.7, "slug": "pagelayer", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-4315-01": {"ajax_action": "cwp_user_data", "conditions": [{"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(?:capabilities|user_level)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via arbitrary user meta update on cwp_user_data AJAX action (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_capabilities", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_user_level", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4334-01": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^wpr\\\\[[^\\\\]]*\\\\]\\\\[(?:[a-z0-9_]*_)?capabilities\\\\]|^wpr\\\\[[^\\\\]]*\\\\]\\\\[wp_user_level\\\\]~i"}], "cve": "CVE-2025-4334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4334", "description": "Simple User Registration <=6.3 unauthenticated privilege escalation via arbitrary wp_capabilities meta injection in wpr_submit_form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.3"}, "RULE-CVE-2025-4367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wpdm_user_dashboard"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_user_dashboard\\\\b[^\\\\]]*(?:]*[\\"\']link[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:|data\\\\s*:|]|javascript *:)~i"}], "cve": "CVE-2025-4429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4429", "description": "Gearside Developer Dashboard <=1.0.72 unauthenticated reflected XSS via data parameter in gearside_search_theme_files AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "gearside-developer-dashboard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.72"}, "RULE-CVE-2025-4473-01": {"ajax_action": "fed_ajax_request", "conditions": [{"name": "ARGS:fed_action_hook", "type": "regex", "value": "~^FEDEmail@(update|update_smtp)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4473", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": ">=1.5.10 <=2.2.7"}, "RULE-CVE-2025-4474-01": {"ajax_action": "fed_admin_setting_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4474", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-4479-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:before_label|after_label)[^:]*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*?(?:<\\\\s*(?:script|iframe|svg|object|embed|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keyup|keydown|keypress|animationend|toggle)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4479", "description": "ElementsKit Lite <=3.5.2 Stored XSS via Image Comparison widget before/after labels through Elementor editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4523-01": {"ajax_action": "admin_donor_profile_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4523", "description": "IDonate <=2.1.9 missing authorization on admin_donor_profile_view AJAX handler exposes sensitive user data", "mode": "block", "severity": 6.5, "slug": "idonate", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-4579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-content-security-policy/v1/report(/|\\\\?|&|$)~"}, {"name": "ARGS:csp-report", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|body|video|audio|form|base|style|meta|details|math)[\\\\s/>]|on(?:load|error|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4579", "description": "WP Content Security Plugin <=2.3 unauthenticated Stored XSS via blocked-uri and effective-directive in CSP report REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-content-security-policy", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-4593-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/[0-9]+)?/?(?:[?#]|$)|/(?:index\\\\.php)?\\\\?(?:[^#&]*&)*rest_route=/wp/v2/posts(?:/[0-9]+)?/?(?:[&#]|$))~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in REST post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4594-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:]+onerror|]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (post editor vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4594-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:]+onerror|]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (REST API vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4597-01": {"ajax_action": "woo_slide_pro_delete_draft_preview", "conditions": [{"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-4597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4597", "description": "Woo Slider Pro <=1.12 missing authorization on woo_slide_pro_delete_draft_preview AJAX action allows Subscriber+ arbitrary post deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woo-slider-pro-drag-drop-slider-builder-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-deletion"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-4602-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file filename path traversal", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4602-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:entity_type", "type": "regex", "value": "~^(?:\\\\.|\\\\.\\\\.)$|(?:\\\\.\\\\.[/\\\\\\\\])~"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file entity_type directory escape", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4610-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmem_user_memberships\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|details|embed|object|video|audio|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|focusin|pointerover)\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-4610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4610", "description": "WP-Members <=3.5.2 Stored XSS via [wpmem_user_memberships] shortcode attributes in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4610-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmem_user_memberships\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|details|embed|object|video|audio|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|focusin|pointerover)\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-4610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4610", "description": "WP-Members <=3.5.2 Stored XSS via [wpmem_user_memberships] shortcode attributes in REST API post creation/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4611-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-4611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-46244-01": {"ajax_action": "dsalv_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-02": {"ajax_action": "dsalv_add_new_variation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-03": {"ajax_action": "dsalv_searchalltags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46254-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:vcv-settings", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-46254", "description": "Visual Composer Website Builder <=45.10.0 contributor+ stored XSS via vcv-settings element attributes", "method": "POST", "mode": "block", "severity": 6.5, "slug": "visualcomposer", "target": "plugin", "versions": "<=45.10.0"}, "RULE-CVE-2025-46490-01": {"ajax_action": "ccpuz_save_crossword_mce_from", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-46490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-46490", "description": "Crossword Compiler Puzzles <=5.2 subscriber+ arbitrary file upload via ccpuz_save_crossword_mce_from AJAX handler", "mode": "block", "severity": 9.9, "slug": "crossword-compiler-puzzles", "tags": ["arbitrary-file-upload", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=5.2"}, "RULE-CVE-2025-4652-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~broadstreet/Broadstreet/Vendor/broadstreet-partner/index\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:next", "type": "detectXSS"}], "cve": "CVE-2025-4652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4652", "description": "Broadstreet <= 1.51.7 Reflected XSS via unsanitized next parameter in broadstreet-partner index.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "broadstreet", "tags": ["xss", "reflected-xss", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.51.7"}, "RULE-CVE-2025-4666-01": {"ajax_action": "zpAccountsViaAJAX", "conditions": [{"name": "ARGS:nickname", "type": "detectXSS"}], "cve": "CVE-2025-4666", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4666", "description": "Zotpress <=7.3.15 Stored XSS via nickname parameter in zpAccountsViaAJAX AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "zotpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.3.15"}, "RULE-CVE-2025-4667-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in post_content (post.php vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in content (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4669-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[wpbc\\\\b[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4671-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode operator attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*pre\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode pre attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*post\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode post attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*(?:pre|post)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4672-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta GET endpoint reading sensitive user meta (wp_capabilities, session_tokens)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta POST endpoint creating sensitive user meta (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta PUT endpoint updating sensitive user meta (wp_capabilities)", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta DELETE endpoint removing sensitive user meta (wp_capabilities)", "method": "DELETE", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4685-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|applet)\\\\b~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via dangerous tag injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4691-01": {"ajax_action": "view_request_details", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-02": {"ajax_action": "view_request_details_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_car booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-03": {"ajax_action": "view_request_details_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_restau booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-04": {"ajax_action": "view_hotel_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_hotel_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-05": {"ajax_action": "view_car_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_car_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-06": {"ajax_action": "view_restau_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_restau_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-07": {"ajax_action": "approve_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-08": {"ajax_action": "decline_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-09": {"ajax_action": "approve_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-10": {"ajax_action": "decline_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-11": {"ajax_action": "approve_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-12": {"ajax_action": "decline_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-47452-01": {"ajax_action": "wpvr_file_import", "conditions": [{"name": "FILES:wpvr_import_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47452", "description": "WP VR <=8.5.26 authenticated arbitrary file upload via wpvr_file_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "wpvr", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=8.5.26"}, "RULE-CVE-2025-47461-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:sfwc_nonce_frontend_edit_subaccount_form", "type": "exists"}, {"name": "ARGS:user", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47461-02": {"ajax_action": "sfwc_frontend_edit_subaccount", "conditions": [{"name": "ARGS:ajax_user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47549-01": {"ajax_action": "beaf_options_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 authenticated arbitrary file upload via beaf_options_save AJAX handler (missing authorization)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47549-02": {"ajax_action": "beaf_options_save", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 arbitrary PHP file upload via beaf_options_save AJAX handler (dangerous file type)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47588-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules(?:/|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API POST /awdp/v1/rules/ in aco-woo-dynamic-pricing <= 4.5.9. Prevents PHP callable names from being stored as rule data that later reaches call_user_func sinks.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47588-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules/\\\\d+(?:/|$|\\\\?)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API PUT /awdp/v1/rules/{id} in aco-woo-dynamic-pricing <= 4.5.9. Covers the update path for the same stored-callback code injection vector.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47601-01": {"ajax_action": "maxi_get_option", "conditions": [{"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47601", "method": "POST", "mode": "block", "severity": 8.8, "slug": "maxi-blocks", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-47636-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (classic editor)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47636-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (block editor / REST API)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47688-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/hide-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47688-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/minimize-maximize-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47690-01": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-02": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-05": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-06": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-4783-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:elements", "type": "regex", "value": "~exad.?countdown~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:(?:<|\\\\\\\\u003[cC]|\\\\\\\\x3[cC])\\\\s*(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|isindex|form|button|textarea|select|base|link|style|applet)|\\\\bon(?:mouse(?:over|out|enter|move|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|drag|drop|pointer|touch|animate|transition|toggle|resize|scroll|wheel|(?:before)?input|play|seek|ended|abort|invalid|select|cut|copy|paste|contextmenu|reset|unload|beforeunload|pageshow|popstate|hashchange|message|storage|online|offline|(?:before)?print|readystatechange|DOMContentLoaded)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4783", "description": "Exclusive Addons for Elementor <=2.7.9.1 Stored XSS via Countdown Timer widget settings in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=2.7.9.1"}, "RULE-CVE-2025-4783-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~exad.?countdown~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:(?:<|\\\\\\\\u003[cC]|\\\\\\\\x3[cC])\\\\s*(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|isindex|form|button|textarea|select|base|link|style|applet)|\\\\bon(?:mouse(?:over|out|enter|move|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|drag|drop|pointer|touch|animate|transition|toggle|resize|scroll|wheel|(?:before)?input|play|seek|ended|abort|invalid|select|cut|copy|paste|contextmenu|reset|unload|beforeunload|pageshow|popstate|hashchange|message|storage|online|offline|(?:before)?print|readystatechange|DOMContentLoaded)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4783", "description": "Exclusive Addons for Elementor <=2.7.9.1 Stored XSS via Countdown Timer widget settings in Elementor REST API save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.9.1"}, "RULE-CVE-2025-4799-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "download-manager.php"}, {"name": "ARGS:file_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:)~"}], "cve": "CVE-2025-4799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799", "description": "WP-DownloadManager <=1.68.10 authenticated (Administrator+) arbitrary file deletion via absolute path traversal in file_name parameter on download-manager.php admin page", "mode": "block", "severity": 7.2, "slug": "wp-downloadmanager", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.68.10"}, "RULE-CVE-2025-4799-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "download-options.php"}, {"name": "ARGS:download_path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^(?!/var/www/html/wp-content|/home/[^/]+/[^/]+/wp-content)[/])~"}], "cve": "CVE-2025-4799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799", "description": "WP-DownloadManager <=1.68.10 authenticated (Administrator+) download_path manipulation enabling arbitrary file deletion chain on download-options.php admin page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-downloadmanager", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.68.10"}, "RULE-CVE-2025-4803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:posttypes", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-4803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4803", "description": "Glossary by WPPedia <=1.3.0 authenticated (Administrator+) PHP Object Injection via posttypes parameter deserialization", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wppedia", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-48101-01": {"ajax_action": "ctct_form_designer", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via ctct_form_designer AJAX handler", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48101-02": {"ajax_action": "ctct_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via ctct_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48101-03": {"action": "template_redirect", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via template_redirect form processing", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48140-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_change\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_change shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "/(?:wp-admin/(?:post\\\\.php|post-new\\\\.php)|wp-json/|xmlrpc\\\\.php)~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_carat\\\\b[^\\\\]]*\\\\bbase\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<\\\\?(?:php|=)|\\\\b(?:phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert)\\\\s*\\\\(|\\\\bpreg_replace\\\\s*\\\\([^)]*/e|`[^`]+`|\\\\$\\\\{?[_A-Za-z])[^\\"\'\\\\]]*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_carat shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48142-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-03": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-04": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-49076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:theplus_clients_url", "type": "exists"}, {"name": "ARGS:theplus_clients_url", "type": "regex", "value": "~^\\\\s*(javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-49076", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.2.7"}, "RULE-CVE-2025-49235-01": {"ajax_action": "get_installed_template", "conditions": [{"name": "ARGS:template_id", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via template_id in get_installed_template AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49235-02": {"ajax_action": "template_category", "conditions": [{"name": "ARGS:category", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via category in template_category AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49244-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - Reflected XSS via su_generator_preview AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49244-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - XSS/Code Execution via su_generator_settings AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49359-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49359-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49360-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49360-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49408-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/templately/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49408", "description": "Templately <=3.2.7 sensitive data exposure via unauthenticated access to REST API settings endpoint", "mode": "block", "severity": 10.0, "slug": "templately", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-4943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in Elementor REST document save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in wp-admin post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in elementor_ajax save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-49924-01": {"ajax_action": "wwpEditWholesaleRole", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49924", "description": "Wholesale Suite \\u2013 WooCommerce Wholesale Prices <=2.2.4.2 privilege escalation via wwpEditWholesaleRole AJAX action", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woocommerce-wholesale-prices", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.4.2"}, "RULE-CVE-2025-49941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49950-01": {"ajax_action": "wc_billingo_generate_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_generate_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49950-02": {"ajax_action": "wc_billingo_storno_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_storno_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_key", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_key)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-49960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_secret", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_secret)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-50003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-50003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-5018-01": {"ajax_action": "hs_update_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_update_ai_chat_settings AJAX handler allows authenticated users to overwrite AI chat configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-02": {"ajax_action": "hive_lite_support_get_all_binbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hive_lite_support_get_all_binbox AJAX handler allows authenticated users to read sensitive inbox configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-03": {"ajax_action": "hs_get_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_get_ai_chat_settings AJAX handler allows authenticated users to read OpenAI API key and AI configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5035-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5035-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus", "rest-api"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5058-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_image"}, {"name": "ARGS:image_id", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5058-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5071-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/messages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5071-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/sse(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "GET", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~attachmentEditIframe\\\\.php~"}, {"name": "ARGS:attachment_id", "type": "detectXSS"}], "cve": "CVE-2025-5082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5082", "description": "WP Attachments <=5.0.12 reflected XSS via attachment_id parameter in attachmentEditIframe.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-attachments", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.12"}, "RULE-CVE-2025-5083-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_options"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via plugin settings (wpgov_at_options) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5083-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_option_groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via group configuration (wpgov_at_option_groups) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5084-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[read_more_text]", "type": "regex", "value": "~<[^>]*[\\\\s/]on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|svg|math|base|link|meta|style|form|input|select|textarea|details|body|marquee)\\\\b|javascript\\\\s*:~i"}], "cve": "CVE-2025-5084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5084", "description": "Post Grid Master <=3.4.13 reflected XSS via argsArray[read_more_text] in asr_filter_posts AJAX handler", "mode": "block", "severity": 6.1, "slug": "ajax-filter-posts", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.4.13"}, "RULE-CVE-2025-5096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_caption]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_caption table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_title]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_title table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_footer]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_footer table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_content_padding]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_content_padding table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5116-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_html(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_html REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_query(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_query REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_data REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-04": {"ajax_action": "async_wppic_shortcode_content", "conditions": [{"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 stored XSS via containerid parameter in async shortcode AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5117-01": {"action": "init", "conditions": [{"name": "ARGS:iv-submit-listing", "type": "equals", "value": "register"}, {"name": "ARGS:payment_gateway", "type": "equals", "value": "paypal"}, {"name": "ARGS:package_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5117-02": {"action": "init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "iv_payment"}, {"name": "ARGS:property_package_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|admin)(?:\\\\s|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5122-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts/\\\\d+(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5144-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "tribe_events"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-(?:date[a-z-]*|provide)\\\\s*=[^>]*(?:<\\\\s*script|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5144", "description": "The Events Calendar <=6.13.2 Stored XSS via data-date-* attributes in event post content (wp-admin post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-events-calendar", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=6.13.2"}, "RULE-CVE-2025-5234-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post create/update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post update (PUT)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in classic editor post.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5237-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[brid[^\\\\]]*(?:width|height)\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=||on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5239", "description": "Domain For Sale <=3.0.10 Authenticated (Contributor+) Stored XSS via class_name parameter in Gutenberg block post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "domain-for-sale", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2025-5240-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCita(?:MeetingScheduler|ContactForm)[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaMeetingScheduler/vCitaContactForm", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5240-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCitaSchedulingCalendar[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaSchedulingCalendar", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5258-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:\\\\[conf_scheduler[^\\\\]]*className\\\\s*=\\\\s*[\\"\'][^\\"\']*|conf-scheduler/display[^}]*className[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*)(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<[a-z/])~i"}], "cve": "CVE-2025-5258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5258", "description": "Conference Scheduler <=2.5.1 Stored XSS via className attribute in shortcode/block (classic editor vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "conference-scheduler", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-5259-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:minimal-share-buttons|msb_share)[^>\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:]*\\\\bonerror\\\\s*=|<\\\\s*svg\\\\b[^>]*\\\\bonload\\\\s*=|<\\\\s*iframe\\\\b|\\\\bsrc\\\\s*=\\\\s*[\'\\\\\\"]?\\\\s*javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|change|submit|keydown|keyup|keypress|dblclick|contextmenu|wheel|pointerdown|animationend|toggle|resize)\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-5290", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5290", "description": "Borderless \\u2013 Elementor Addons and Templates <=1.7.1 Authenticated (Contributor+) Stored XSS via Elementor widget title settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "borderless", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5304-01": {"ajax_action": "wpnb_pto_new_users_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-02": {"ajax_action": "wpnb_pto_users_deletd", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-03": {"ajax_action": "wpnb_pto_new_email_system_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5314-01": {"action": "init", "conditions": [{"name": "ARGS:pdf-source", "type": "regex", "value": "~(?:]|j[^a-z]*a[^a-z]*v[^a-z]*a[^a-z]*s[^a-z]*c[^a-z]*r[^a-z]*i[^a-z]*p[^a-z]*t[^a-z]*:|on(?:load|error|mouseover|click|focus|blur)[ ]*=|<(?:img|svg|iframe|embed|object)[ /][^>]*on[a-z]+=)~i"}], "cve": "CVE-2025-5314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5314", "description": "Dear Flipbook <=2.3.65 DOM-Based Reflected XSS via pdf-source query parameter", "mode": "block", "severity": 6.1, "slug": "3d-flipbook-dflip-lite", "tags": ["xss", "dom-based-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.65"}, "RULE-CVE-2025-53303-01": {"ajax_action": "import_content_xml", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_content_xml AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-02": {"ajax_action": "import_demo", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_demo AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-03": {"ajax_action": "import_widgets_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_widgets_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-04": {"ajax_action": "import_customizer_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_customizer_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-05": {"ajax_action": "import_page_options_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_page_options_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-06": {"ajax_action": "import_elementor_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_elementor_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-07": {"ajax_action": "import_menus_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_menus_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-08": {"ajax_action": "import_woocommerce_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_woocommerce_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-09": {"ajax_action": "import_ess_grid_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_ess_grid_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-10": {"ajax_action": "import_rev_sliders_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_rev_sliders_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-11": {"ajax_action": "import_instagram_feed_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_instagram_feed_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-12": {"ajax_action": "download_media_package", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 unauthorized access via download_media_package AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-5336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ht[_-]ctc[_-]chat\\\\b[^\\\\]]*\\\\bno_number\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|&#x?[0-9a-f]+;)~i"}], "cve": "CVE-2025-5336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5336", "description": "Click to Chat for WhatsApp <=4.22 Stored DOM-Based XSS via shortcode no_number attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.22"}, "RULE-CVE-2025-5337-01": {"ajax_action": "ms_save_slideshow", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=)|<(?:script|img|svg|iframe|object|embed|video|audio|source|link|meta|base|form|details)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5337", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5337", "description": "MetaSlider <=3.98.0 Stored DOM-Based XSS via aria-label parameter in ms_save_slideshow AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ml-slider", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.98.0"}, "RULE-CVE-2025-5340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~album_buy_url[^}]{0,80}(?:<[a-z/!][^>]*>|javascript\\\\s*:|data\\\\s*:[^,]*text/html|on(?:error|load|click|mouse)\\\\s*=)~i"}], "cve": "CVE-2025-5340", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5340", "description": "Music Player for Elementor <=2.4.6 authenticated (Contributor+) Stored XSS via album_buy_url widget setting", "method": "POST", "mode": "block", "severity": 6.4, "slug": "music-player-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-5341-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:structure", "type": "regex", "value": "~(?i)(?:\\\\bon[a-zA-Z]+\\\\s*=|<(?:script|img|svg|iframe|object|embed)[\\\\s/>])~"}], "cve": "CVE-2025-5341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5341", "description": "Forminator <=1.44.1 Authenticated (Contributor+) Stored DOM-Based XSS via rating field configuration in forminator_save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forminator", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.44.1"}, "RULE-CVE-2025-53428-01": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-02": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-03": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-04": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53430-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53430-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53441-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53442-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53442-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53443-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53445-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53445-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53446-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53446-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53447-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53447-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53449-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53449-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53453-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53454-01": {"action": "save_post", "conditions": [{"name": "ARGS:ewd_uwpm_email_content", "type": "detectXSS"}], "cve": "CVE-2025-53454", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ultimate-wp-mail", "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2025-5391-01": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated arbitrary file deletion via path traversal in file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5391-02": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|wp-settings\\\\.php)~i"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated sensitive file deletion via file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5398-01": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-02": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-03": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-04": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-05": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-06": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-54003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54010-01": {"ajax_action": "fluent_snippets_import_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet import via fluent_snippets_import_json AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54010-02": {"ajax_action": "fluent_snippets_export_snippets", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet export via fluent_snippets_export_snippets AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54710-01": {"ajax_action": "ttp_tiktok_clear", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ttp_tiktok_clear"}, {"name": "ARGS:nonce", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54710", "mode": "block", "severity": 7.1, "slug": "b-tiktok-feed", "target": "plugin", "versions": "<=1.0.21"}, "RULE-CVE-2025-54714-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/message(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54714-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/delete(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54734-01": {"ajax_action": "activated_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-02": {"ajax_action": "get_popular_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-03": {"ajax_action": "get_active_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-5490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "footballpool-options"}, {"name": "ARGS", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouseover|toggle|focus)\\\\s*=|javascript\\\\s*:|]*>|]*on|]*>|]*>~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 stored XSS via admin settings page option fields", "method": "POST", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5490-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^footballpool-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5532-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp_autosave][content]", "type": "contains", "value": "emd_mb_meta"}, {"name": "ARGS:data[wp_autosave][content]", "type": "regex", "value": "~<(?:script|iframe|embed|object|svg|math|link|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in autosave content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5533-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[kbalert\\\\b~i"}, {"name": "ARGS:content", "type": "regex", "value": "~]*>|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|change|key(?:up|down|press))\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5540", "description": "WP Easy Events <=4.1.0 Authenticated (Contributor+) Stored XSS via emd_mb_meta shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-easy-events", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-5567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Reflected XSS via su_lightbox shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5568-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_location_venue", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_location_venue field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_street", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_street field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_city", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_city field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_state", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_state field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_postcode", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_postcode field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_country", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_country field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_name_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_name_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_email_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_email_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_phone_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_phone_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_address_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_address_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-11": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_tshirt_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_tshirt_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-12": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_gender_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_gender_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-13": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_company_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_company_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-14": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_desg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_desg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-15": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_website_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_website_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-16": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_veg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_veg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-17": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-18": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-19": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-20": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-21": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-22": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-23": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-24": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5585-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5585-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "rest-api", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5588-01": {"action": "init", "conditions": [{"name": "ARGS:download", "type": "detectXSS"}], "cve": "CVE-2025-5588", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5588", "description": "Image Editor by Pixo <=2.3.6 Authenticated (Contributor+) Stored XSS via download parameter in [pixoeditor] shortcode", "mode": "block", "severity": 6.4, "slug": "image-editor-by-pixo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-5673-01": {"action": "admin_init", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on admin page render", "method": "GET", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5673-02": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on b2s_sort_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5678-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5678-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5684-01": {"ajax_action": "metform_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via metform_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5684-02": {"ajax_action": "mf_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via mf_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5692-01": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveCRMconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-02": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveSuiteconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveZohoSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSFSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-05": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on adminAllActionsPRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-06": {"ajax_action": "Sync_settings_PRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on Sync_settings_PRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-07": {"ajax_action": "captcha_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on captcha_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-08": {"ajax_action": "droptable_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on droptable_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-09": {"ajax_action": "TFA_auth_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on TFA_auth_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-10": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_apikey AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-11": {"ajax_action": "createnew_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on createnew_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-12": {"ajax_action": "save_convert_lead", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_convert_lead AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-13": {"ajax_action": "save_campaign_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_campaign_details AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-14": {"ajax_action": "import_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on import_file AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-15": {"ajax_action": "file_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on file_import AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-16": {"ajax_action": "download_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on download_json AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "data-exfiltration"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-17": {"ajax_action": "wp_usersync_assignedto", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on wp_usersync_assignedto AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-18": {"ajax_action": "mappingmodulepro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on mappingmodulepro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-19": {"ajax_action": "saveSyncValue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSyncValue AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-20": {"ajax_action": "send_mapping_configuration", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapping_configuration AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-21": {"ajax_action": "get_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on get_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-22": {"ajax_action": "map_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-23": {"ajax_action": "save_thirdparty_form_title", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_thirdparty_form_title AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-24": {"ajax_action": "send_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-25": {"ajax_action": "delete_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on delete_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-26": {"ajax_action": "zohoCRMRedirect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on zohoCRMRedirect AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-27": {"ajax_action": "save_usersync_RR_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_usersync_RR_option AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-28": {"ajax_action": "customfieldpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on customfieldpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-29": {"ajax_action": "change_ecom_module_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on change_ecom_module_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-30": {"ajax_action": "map_ecom_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_ecom_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-31": {"ajax_action": "map_sync_user_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_sync_user_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-32": {"ajax_action": "selectplugpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on selectplugpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5700-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[simple-logo-carousel[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5700", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5700", "description": "Simple Logo Carousel <=1.9.3 Stored XSS via shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-logo-carousel", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2025-5720-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:author", "type": "detectXSS"}], "cve": "CVE-2025-5720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5720", "description": "Customer Reviews for WooCommerce <=5.80.2 unauthenticated stored XSS via author parameter in AJAX review submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.80.2"}, "RULE-CVE-2025-5753-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:�*58;|�*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|�*34;|�*39;|"|�*22;|�*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5753-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:�*58;|�*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|�*34;|�*39;|"|�*22;|�*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5813-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-amazon-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-amazon-product/v1/keyword REST route enables arbitrary product creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-urls/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-urls/v1/keyword REST route enables SSRF-style URL fetching", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-product/v1/keyword REST route enables unauthorized product data retrieval", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-58207-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/fetch-bulk-alt-text(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/delete-bulk-generating-status(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-03": {"ajax_action": "send_bulk_images", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-58225-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-5841-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:the-countdown[\\\\s\\\\S]{0,500}clientId\\\\s*\\"?\\\\s*:\\\\s*\\\\\\"[^\\\\\\"]{0,200}(?:])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5929", "description": "The Countdown <=2.0.1 Stored XSS via clientId block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-countdown", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-5950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5953-01": {"ajax_action": "hrm_insert_employee", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2025-5953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5953", "description": "WP Human Resource Management <=2.2.17 missing authorization on hrm_insert_employee allows authenticated privilege escalation via role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hrm", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=2.2.17"}, "RULE-CVE-2025-5957-01": {"ajax_action": "guest_support_handler", "conditions": [{"name": "ARGS:request", "type": "equals", "value": "delete_tickets"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5957", "description": "Guest Support <=1.2.2 missing authorization on mass ticket deletion via guest_support_handler AJAX endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "guest-support", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2025-5961-01": {"ajax_action": "wpvivid_upload_import_files", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:php\\\\d*|phtml|phar|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\x00|%00|$)~i"}], "cve": "CVE-2025-5961", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.116"}, "RULE-CVE-2025-5983-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_meta[type]", "type": "equals", "value": "http-equiv"}, {"name": "ARGS:mtm_meta[value]", "type": "equals", "value": "refresh"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5983", "description": "Meta Tag Manager <3.3 Contributor+ open redirect via http-equiv refresh meta tag injection on post save", "method": "POST", "mode": "block", "severity": 6.5, "slug": "meta-tag-manager", "tags": ["open-redirect", "missing-authorization", "meta-refresh"], "target": "plugin", "versions": "<3.3"}, "RULE-CVE-2025-60041-01": {"ajax_action": "secas_navigate_to_page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-60041", "mode": "block", "severity": 8.8, "slug": "emails-catch-all", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2025-60042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60042-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60043-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60043-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60044-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60044-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60046-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60046-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60047-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60047-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60048-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60048-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60049-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60049-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60050-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60050-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60051-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60051-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60052-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60052-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60053-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60053-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60054-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60054-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60055-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60055-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60056-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60057-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60057-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60060-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60060-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60061-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60061-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60063-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60063-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60065-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60065-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60066-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60067-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60195-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpf_create_account"}, {"name": "ARGS:role", "type": "regex", "value": "~^\\\\s*(?:administrator|editor|author)\\\\s*$~i"}], "cve": "CVE-2025-60195", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-60195", "description": "Atarim Visual Collaboration <=4.2.1 unauthenticated privilege escalation via wpf_create_account AJAX action with attacker-supplied role parameter", "method": "POST", "mode": "block", "severity": 9.8, "slug": "atarim-visual-collaboration", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-60245-01": {"action": "init", "conditions": [{"name": "ARGS:submit_account", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-60245", "description": "WP User Manager <=2.9.12 authenticated PHP object injection via account form deserialization", "mode": "block", "severity": 9.8, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-6025-01": {"ajax_action": "apply_tip", "conditions": [{"name": "ARGS:tip", "type": "regex", "value": "~^\\\\s*-~"}], "cve": "CVE-2025-6025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6025", "description": "Order Tip for WooCommerce <=1.5.4 unauthenticated negative tip manipulation via apply_tip AJAX action", "method": "POST", "mode": "block", "severity": 7.5, "slug": "order-tip-woo", "tags": ["improper-input-validation", "business-logic", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-6068-01": {"ajax_action": "foogallery_attachment_modal_save", "conditions": [{"name": "ARGS:foogallery", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~]*>[^<]*[^<\\\\s]|\\\\bon(?:error|load|mouseover|focus|click|mouseenter)\\\\s*=\\\\s*[\\"\']|(?:[=\\"\'(\\\\s]|^)\\\\s*javascript\\\\s*:\\\\s*(?:void|alert|confirm|prompt|eval|document|window|fetch|location|[(\\\\[\'\\"]|//)~i"}], "cve": "CVE-2025-6068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6068", "description": "FooGallery <=2.4.31 Stored XSS via attachment modal save caption fields", "method": "POST", "mode": "block", "severity": 5.4, "slug": "foogallery", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.31"}, "RULE-CVE-2025-6085-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-6085", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6085", "description": "Make (Integromat) Connector <=1.5.10 arbitrary file upload of executable files via REST media endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "integromat-connector", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.5.10"}, "RULE-CVE-2025-6184-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-6184", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6184", "description": "Tutor LMS Pro <=3.7.0 authenticated SQL injection via order parameter in assignment listing", "method": "GET", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.7.0"}, "RULE-CVE-2025-6190-01": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_capabilities meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-6190-02": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_user_level meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-62007-01": {"ajax_action": "bplvf_save_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_save_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-02": {"ajax_action": "bplvf_delete_user_feedback", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_delete_user_feedback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-03": {"ajax_action": "bplvf_toggle_resolved", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_toggle_resolved"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-04": {"ajax_action": "bplvf_get_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_get_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-6201-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[conversion-pixel[^\\\\]]*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6201", "description": "Pixel Manager for WooCommerce <=1.49.0 Stored XSS via conversion-pixel shortcode attributes in classic editor (REST API JSON body vector not interceptable due to engine limitation)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-google-adwords-conversion-tracking-tag", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.49.0"}, "RULE-CVE-2025-62022-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/buddypress/v1/signups/activate(/|\\\\?|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62022-02": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/buddypress/v1/signups/activate(/|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62065-01": {"ajax_action": "rtm_handle_upload_template", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-62065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62065", "description": "RomethemeKit <=1.6.5 authenticated arbitrary file upload via rtm_handle_upload_template AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-6207-01": {"ajax_action": "wpie_tempalte_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6207", "description": "WP Import Export Lite <=3.9.28 authenticated arbitrary file upload via wpie_tempalte_import AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-import-export-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=3.9.28"}, "RULE-CVE-2025-6212-01": {"ajax_action": "uacf7dp_get_table_data", "conditions": [{"name": "ARGS:form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_get_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6212-02": {"ajax_action": "uacf7dp_view_table_data", "conditions": [{"name": "ARGS:cf7_form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_view_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6213-01": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "preload_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on preload_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6213-02": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "purge_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on purge_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6220-01": {"ajax_action": "uacf7_options_save", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2025-6220", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6220", "description": "Ultimate Addons for Contact Form 7 <=3.5.12 arbitrary file upload via save_options allowing PHP webshell upload to itinerary-fonts directory", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-addons-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.5.12"}, "RULE-CVE-2025-6221-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24529-01": {"ajax_action": "cancel", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on cancel AJAX action allows authenticated users to cancel bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-02": {"ajax_action": "confirm_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on confirm_email AJAX action allows authenticated users to confirm bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-03": {"ajax_action": "pending_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on pending_email AJAX action allows authenticated users to set bookings to pending", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-04": {"ajax_action": "reject_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on reject_email AJAX action allows authenticated users to reject bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24532-01": {"ajax_action": "sitelock_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_scan AJAX handler allows subscribers to trigger scans", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24532-02": {"ajax_action": "sitelock_dismiss_notice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_dismiss_notice AJAX handler allows subscribers to dismiss admin notices", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=bab_Dashboard~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24565", "mode": "block", "severity": 6.5, "slug": "b-accordion", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-24572-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nelio-content/v1/posts(/|\\\\?|$)~"}, {"name": "ARGS:searchTerm", "type": "regex", "value": "~(?:\'[ \\\\t]*(?:OR|AND)[ \\\\t]+[0-9]|UNION[ \\\\t]+(?:ALL[ \\\\t]+)?SELECT|\'[ \\\\t]*(?:--|#)|SLEEP[ \\\\t]*\\\\(|BENCHMARK[ \\\\t]*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24572", "description": "Nelio Content <=4.2.0 authenticated (Contributor+) SQL injection via searchTerm in REST posts endpoint", "method": "GET", "mode": "block", "severity": 8.8, "slug": "nelio-content", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-24596-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "relpoststh_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-24596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24596", "description": "Related Posts Thumbnails <=4.3.2 CSRF to stored XSS via unsanitized plugin settings in head_style output", "method": "POST", "mode": "block", "severity": 4.7, "slug": "related-posts-thumbnails", "tags": ["csrf", "stored-xss", "settings-update"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-24616-01": {"ajax_action": "wppopups_settings_provider_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_add AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24616-02": {"ajax_action": "wppopups_settings_provider_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_disconnect AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24623-01": {"action": "init", "conditions": [{"name": "ARGS:forum", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via forum parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-02": {"action": "init", "conditions": [{"name": "ARGS:topic", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via topic parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-03": {"ajax_action": "neoforum_get_new_topic_form", "conditions": [{"name": "ARGS:forumid", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 authenticated reflected XSS via forumid parameter in neoforum_get_new_topic_form AJAX handler", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-01": {"ajax_action": "neoforum_close_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in close_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-02": {"ajax_action": "neoforum_restrict_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in restrict_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-03": {"ajax_action": "neoforum_delete_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in delete_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-04": {"ajax_action": "neoforum_edit_forum_title", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_title AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-05": {"ajax_action": "neoforum_edit_forum_descr", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-06": {"ajax_action": "neoforum_delete_moderators", "conditions": [{"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via type in delete_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-07": {"ajax_action": "neoforum_add_moderators", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in add_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-08": {"ajax_action": "neoforum_topic_restore", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-09": {"ajax_action": "neoforum_topic_eradicate", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-10": {"ajax_action": "neoforum_post_restore", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-11": {"ajax_action": "neoforum_post_eradicate", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-12": {"ajax_action": "neoforum_report_leave_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_leave_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-13": {"ajax_action": "neoforum_report_delete_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_delete_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-14": {"ajax_action": "neoforum_ban_user", "conditions": [{"name": "ARGS:ban", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via ban in ban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-15": {"ajax_action": "neoforum_unban_user", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in unban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-16": {"ajax_action": "neoforum_make_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in make_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-17": {"ajax_action": "neoforum_remove_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in remove_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-18": {"ajax_action": "neoforum_delete_topic", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in delete_topic AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-19": {"ajax_action": "neoforum_theme_descr", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|[\\\\/\\\\\\\\]etc[\\\\/\\\\\\\\]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated local file inclusion via theme in theme_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24637-01": {"ajax_action": "powerpress_media_info", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24637", "description": "Blocks unauthenticated/low-privilege SQL injection via powerpress_media_info AJAX handler (CWE-89, Contributor+ SQLi in PowerPress <= 11.15.10). Requires edit_posts capability, mirroring the vendor patch.", "mode": "block", "severity": 8.5, "slug": "powerpress", "target": "plugin", "versions": "<=11.15.10"}, "RULE-CVE-2026-2471-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"[^\\"]*\\":\\\\d+:\\\\{~"}], "cve": "CVE-2026-2471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2471", "description": "WP Mail Logging <=1.15.0 unauthenticated PHP Object Injection via serialized object payload in form fields logged by wp_mail hook", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-mail-logging", "tags": ["object-injection", "deserialization", "unauthenticated", "stored-payload"], "target": "plugin", "versions": "<=1.15.0"}, "RULE-CVE-2026-2479-01": {"ajax_action": "rl_upload_image", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2479", "description": "Responsive Lightbox & Gallery <=2.7.1 SSRF via strpos()-based hostname bypass in rl_upload_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "responsive-lightbox", "tags": ["ssrf", "hostname-bypass", "authenticated"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-2486-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ma_el_bh_table_btn_text[\\\\\\"\']\\\\s*:\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<[^>]+\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|]*(?:on[a-zA-Z]+=|(?:href|src|action|formaction|data) *= *[\\"\']? *(?:javascript|data|vbscript) *:))?~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2489", "description": "TP2WP Importer <=1.1 Authenticated (Administrator+) Stored XSS via Watched Domains AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "tp2wp-importer", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-2495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/WPNakama/v1/boards(?:[/?&]|$)~i"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,|CASE\\\\s+WHEN|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2026-2495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2495", "description": "WPNakama <=0.6.5 unauthenticated SQL injection via order parameter on /WPNakama/v1/boards REST endpoint", "mode": "block", "severity": 7.5, "slug": "wpnakama", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.6.5"}, "RULE-CVE-2026-24950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/authorsy/v1/authors(?:/|$|\\\\?)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24950", "description": "Authorsy <=1.0.6 unauthenticated access to REST API author endpoints leaking sensitive user data (IDOR)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "authorsy", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-24952-01": {"ajax_action": "update_episode_embed_code", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~(?:]|]|]|]*\\\\bon[a-z]+\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-24952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24952", "description": "Seriously Simple Podcasting <=3.14.1 authenticated XSS via width parameter in update_episode_embed_code AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "seriously-simple-podcasting", "tags": ["xss", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-24954-01": {"ajax_action": "mpwem_save_faq", "conditions": [{"name": "ARGS:/^mep_faq/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_faq AJAX handler (question/answer fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-02": {"ajax_action": "mpwem_save_timeline", "conditions": [{"name": "ARGS:/^mep_timeline_details/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_timeline AJAX handler (title/desc fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_speaker_list", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_speaker_list)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_event_cc_email_text", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_event_cc_email_text)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:/^mep_ev_more_date/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_ev_more_date)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24956-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpdm-elementor/v1/search-packages(/|\\\\?|&|$)~"}, {"name": "ARGS:term", "type": "regex", "value": "~(?:union(?:/[*][^*]*[*]/|[+[:space:]])+(?:all(?:/[*][^*]*[*]/|[+[:space:]])+)?select|select(?:/[*][^*]*[*]/|[+[:space:]])+.*from|(?:sleep|benchmark)[[:space:]]*[(]|waitfor(?:/[*][^*]*[*]/|[+[:space:]])+delay|load_file[[:space:]]*[(]|into(?:/[*][^*]*[*]/|[+[:space:]])+(?:outfile|dumpfile)|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[0-9]+[[:space:]]*=[[:space:]]*[0-9]+|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]+[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`][^\\"\'`]+[\\"\'`]|[\\"\'`][[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]*[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`])~i"}], "cve": "CVE-2026-24956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24956", "description": "Download Manager Addons for Elementor <=1.3.0 blind SQL injection via term parameter in search-packages REST endpoint", "method": "GET", "mode": "block", "severity": 9.3, "slug": "wpdm-elementor", "tags": ["sql-injection", "blind-sqli", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2026-24957-01": {"ajax_action": "wpmtst_add_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-02": {"ajax_action": "wpmtst_add_field_2", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_2 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-03": {"ajax_action": "wpmtst_add_field_3", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_3 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-04": {"ajax_action": "wpmtst_add_field_4", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_4 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24959-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via id parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-24959-02": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via status parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-2498-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_admins", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_admins settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_app_id", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_app_id settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_site", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_site settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_type", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_card", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_card settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_gp_type", "type": "regex", "value": "~]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|]|]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_gp_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-24984-01": {"ajax_action": "vlp_get_post_content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24984", "description": "Visual Link Preview <=2.2.9 missing authorization on vlp_get_post_content allows unauthorized post content disclosure", "mode": "block", "severity": 6.5, "slug": "visual-link-preview", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-2499-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpcl_custom_logo_path", "type": "regex", "value": "~(]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 unauthenticated stored XSS via customer_name in front-end order form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2506-02": {"action": "admin_init", "conditions": [{"name": "ARGS:cpage", "type": "exists"}, {"name": "ARGS:cpage", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 reflected XSS via cpage parameter on admin Customers page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2509-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?]|]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25369", "description": "Flexmls IDX <=3.15.9 reflected XSS via unsanitized search_referral_url on listing details pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "flexmls-idx", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.15.9"}, "RULE-CVE-2026-25383-01": {"action": "init", "conditions": [{"name": "ARGS:page_url", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|details|math|marquee|isindex|form|input|button|select|textarea|keygen|frameset)\\\\b[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2026-25383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25383", "description": "KiviCare Clinic Management System <=3.6.16 unauthenticated reflected XSS via page_url parameter in popupBookAppointment template", "mode": "block", "severity": 7.1, "slug": "kivicare-clinic-management-system", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25396-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ccwc_hide_notice"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25396", "description": "Commerce Coinbase for WooCommerce <=1.6.7 missing authorization on ccwc_hide_notice admin-post action allows subscriber+ option update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "commerce-coinbase-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-25418-01": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-02": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-03": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-04": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-05": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-06": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-07": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-08": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:fields", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via fields parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-09": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-10": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-11": {"ajax_action": "bitforms_entry_status_update", "conditions": [{"name": "ARGS:entryID", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via entryID parameter in bitforms_entry_status_update AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25429-01": {"ajax_action": "nexa_load_more_posts", "conditions": [{"name": "ARGS:attributes", "type": "regex", "value": "~(?:[OC]:[0-9]+:[\\"\\\\{]|(?:Tzo|Qzo)[0-9A-Za-z+/]*[=]{0,2})~"}], "cve": "CVE-2026-25429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25429", "description": "Nexa Blocks <=1.1.1 unauthenticated PHP object injection via base64-encoded attributes parameter in nexa_load_more_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "nexa-blocks", "tags": ["object-injection", "deserialization", "unauthenticated", "php-object-injection"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-25430-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^log_detail_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on log_detail AJAX action allows subscriber+ to read CRM logs and trigger reflected XSS", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^review_dismiss_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on review_dismiss AJAX action allows subscriber+ to toggle admin notice state", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^get_objects_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing capability check on get_objects AJAX action allows subscriber+ to enumerate CRM objects", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25435-01": {"ajax_action": "wpdevart_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:]|]|]|]|]|]|]|]|]|]|]|]|]|]|]|=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25447-02": {"ajax_action": "ww_form_ajax", "conditions": [{"name": "ARGS:context", "type": "regex", "value": "~(\\\\beval\\\\b|\\\\bsystem\\\\b|shell_exec|\\\\bexec\\\\b|base64_decode|passthru|popen|proc_open|call_user_func|create_function|O:[0-9]+:|<\\\\?php)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25447", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25447", "description": "Widget Wrangler <=2.3.9 code injection via context in ww_form_ajax AJAX handler", "mode": "block", "severity": 9.1, "slug": "widget-wrangler", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": ">=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25452-01": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:\\\\b(?:AND|OR)\\\\b(?:/\\\\*.*?\\\\*/|\\\\s|[\'\\"`()0-9]){0,32}(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])[[:space:]]*=[[:space:]]*(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])|\\\\bUN(?:/\\\\*.*?\\\\*/|\\\\s)*ION\\\\b(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT\\\\b|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b|--\\\\s*[^\\\\r\\\\n]*)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated SQL injection via remoji_id parameter in Reaction::_del", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-02": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:]|][^>]*onload\\\\s*=|][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via remoji_id parameter", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/remoji/v1/add(?:/|\\\\?|$)~"}, {"name": "ARGS:emoji", "type": "regex", "value": "~(?:]|][^>]*onload\\\\s*=|][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via emoji parameter on Remoji REST add route", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "rest-api", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shipi/v1/connect/fedex/?(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25456", "description": "Automated FedEx Shipping <=5.1.8 unauthenticated access to transient nonce data via shipi/v1/connect/fedex REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "a2z-fedex-shipping", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-25471-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "exists"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 broken authentication via OTP submission on wp-login.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["authentication-bypass", "broken-authentication", "unauthenticated", "otp-bypass"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-25471-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "regex", "value": "~(?:]*>|]*onerror[[:space:]]*=|on(?:error|load|mouseover|click)[[:space:]]*=|javascript:)~i"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 reflected XSS via unsanitized tpsa_verify_email_otp on wp-login.php", "method": "GET", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-2554-01": {"ajax_action": "delete_wcfm_customer", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2554", "description": "WCFM <=6.7.25 IDOR allowing authenticated Vendor+ to delete arbitrary users via customerid parameter", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "authorization-bypass", "privilege-escalation"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-2568-01": {"action": "admin_init", "conditions": [{"name": "ARGS:entry_id", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via entry_id parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-02": {"action": "admin_init", "conditions": [{"name": "ARGS:start_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via start_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-03": {"action": "admin_init", "conditions": [{"name": "ARGS:end_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via end_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-04": {"action": "admin_init", "conditions": [{"name": "ARGS:vx_debug", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via vx_debug parameter on admin entry box page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2571-01": {"ajax_action": "wpdmdz_user_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2571", "description": "Download Manager <=3.3.49 missing authorization on wpdmdz_user_status AJAX handler allows subscriber+ user enumeration", "mode": "block", "severity": 4.3, "slug": "download-manager", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=3.3.49"}, "RULE-CVE-2026-2576-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment", "type": "detectSQLi"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment parameter (scalar)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[0]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[1]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter (index 1)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wopb/product-search(/|\\\\?|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2026-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2579", "description": "ProductX/WowStore <=4.4.3 unauthenticated SQL injection via search parameter in wopb/product-search REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "product-blocks", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.4.3"}, "RULE-CVE-2026-2580-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2580", "description": "WP Google Map Plugin <=4.9.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-2582-01": {"ajax_action": "show_direct_debit", "conditions": [{"name": "ARGS:account_holder", "type": "regex", "value": "~\\\\[\\\\s*[a-z_][a-z0-9_]{2,}[\\\\s\\\\]\\\\/]~"}], "cve": "CVE-2026-2582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2582", "description": "Germanized for WooCommerce <=3.20.5 unauthenticated arbitrary shortcode execution via account_holder parameter in direct debit mandate AJAX handler", "mode": "block", "severity": 6.5, "slug": "woocommerce-germanized", "tags": ["code-injection", "shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.20.5"}, "RULE-CVE-2026-2583-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:meta[blocksy_meta]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-2583-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:blocksy_meta", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in classic post editor", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-25863-01": {"ajax_action": "cf7mls_validation", "conditions": [{"name": "ARGS:_count", "type": "regex", "value": "~^\\\\d{4,}$~"}], "cve": "CVE-2026-25863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25863", "description": "Contact Form 7 Conditional Fields <=2.7.3 unauthenticated denial of service via repeater _count parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "cf7-conditional-fields", "tags": ["denial-of-service", "resource-consumption", "unauthenticated"], "target": "plugin", "versions": "<=2.7.3"}, "RULE-CVE-2026-2589-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/plugins/greenshift-animation-and-page-builder-blocks/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in plugin directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/uploads/greenshift/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2592-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "wc_zpal"}, {"name": "ARGS:Status", "type": "equals", "value": "OK"}, {"name": "ARGS:wc_order", "type": "exists"}, {"name": "ARGS:Authority", "type": "regex", "value": "~^[A-Za-z0-9]{16,35}$~"}], "cve": "CVE-2026-2592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2592", "description": "ZarinPal WooCommerce Payment Gateway <=5.0.16 improper access control via wc-api wc_zpal callback with forged short Authority token", "mode": "block", "severity": 7.7, "slug": "zarinpal-woocommerce-payment-gateway", "tags": ["improper-access-control", "payment-bypass", "woocommerce-api", "unauthenticated"], "target": "plugin", "versions": "<=5.0.16"}, "RULE-CVE-2026-2593-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:meta[_gspb_post_css]", "type": "regex", "value": "~]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css post meta through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~greenshift-blocks/element[^}]*dynamicAttributes[^}]*<[a-zA-Z][a-zA-Z0-9]*[ /][^>]*(?:on[a-zA-Z]+=|javascript:|]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css meta through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "classic-editor"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2599-01": {"action": "init", "conditions": [{"name": "ARGS:vx_crm_form_action", "type": "equals", "value": "download_csv"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2599", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2599", "description": "Contact Form Entries <=1.4.7 unauthenticated PHP Object Injection via download_csv deserialization trigger", "method": "GET", "mode": "block", "severity": 9.8, "slug": "contact-form-entries", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.4.7"}, "RULE-CVE-2026-2628-01": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^[A-Za-z0-9_=-]+\\\\.[A-Za-z0-9_=-]+\\\\.?[A-Za-z0-9_=-]*$~"}, {"name": "ARGS:code", "type": "exists"}], "cve": "CVE-2026-2628", "method": "GET", "mode": "block", "severity": 9.8, "slug": "login-with-azure", "target": "plugin", "versions": "<2.2.6"}, "RULE-CVE-2026-27044-01": {"ajax_action": "totalpoll_modules_install_from_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27044", "description": "Total Poll Lite <=4.12.0 authenticated remote code execution via totalpoll_modules_install_from_file AJAX handler", "mode": "block", "severity": 9.9, "slug": "totalpoll-lite", "tags": ["remote-code-execution", "code-injection", "missing-authorization"], "target": "plugin", "versions": "<=4.12.0"}, "RULE-CVE-2026-27053-01": {"ajax_action": "vwls_stream_setup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream_setup AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-02": {"ajax_action": "h5vls_app", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via h5vls_app AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-03": {"ajax_action": "vwls_stream", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27067-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_media REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_font(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_font REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27068-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:llms_generator_settings", "type": "regex", "value": "~(?:]*>||javascript\\\\s*:|on[a-z]+\\\\s*=|]*>|]*>)~i"}], "cve": "CVE-2026-27068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27068", "description": "Website LLMs.txt <=8.2.6 reflected XSS via llms_generator_settings reflected in admin/admin-page.php hidden input attributes", "mode": "block", "severity": 7.1, "slug": "website-llms-txt", "tags": ["xss", "reflected-xss", "admin-page", "crafted-link"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2026-2707-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/weforms/v1/forms/[0-9]+/entries(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-2707-02": {"ajax_action": "weforms_frontend_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through AJAX frontend submit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-27071-01": {"ajax_action": "save_location", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27071", "description": "WPCafe <=3.0.6 unauthenticated broken access control on save_location AJAX handler", "mode": "block", "severity": 9.1, "slug": "wp-cafe", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2026-27072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_head", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_head parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27072-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_footer", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_footer parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27075-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27077-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27077-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27078-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27078-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27080-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27080-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27081-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27081-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27082-01": {"ajax_action": "lovestory_options_import", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_import AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27082-02": {"ajax_action": "lovestory_options_save", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_save AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27094-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:coblocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer\\\\w+)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27094", "description": "CoBlocks <=3.1.16 Contributor+ stored XSS via CoBlocks block attributes in post content", "mode": "block", "severity": 6.5, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-27095-04": {"ajax_action": "get_wbtm_return_date", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_return_date AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-05": {"ajax_action": "get_wbtm_dropping_point", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_dropping_point AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-06": {"ajax_action": "wbtm_create_seat_plan", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-07": {"ajax_action": "wbtm_create_seat_plan_dd", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan_dd AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-08": {"ajax_action": "wbtm_get_bus_detail", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_get_bus_detail AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-09": {"ajax_action": "wbtm_reload_pricing", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_reload_pricing AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-27097-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-2712-01": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp-optimize-heartbeat-smush][command]", "type": "regex", "value": "~^(?:get_smush_logs|clean_all_backup_images|process_bulk_smush|update_smush_options|get_smush_options|clear_smush_stats|clear_backup_images|clear_backup_images_directory|delete_log_files|get_logfile_path)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2712", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2712", "description": "WP-Optimize <=4.5.0 missing authorization in receive_heartbeat() allows subscriber+ to invoke admin-only Smush commands via Heartbeat API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-optimize", "tags": ["incorrect-authorization", "missing-capability", "heartbeat-abuse"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2718-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2721-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:mailarchiver_archiver_privacy_encryption", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2721", "description": "MailArchiver <=4.4.0 authenticated stored XSS via mailarchiver_archiver_privacy_encryption settings field", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mailarchiver", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=4.4.0"}, "RULE-CVE-2026-2724-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "unitecreator_ajax_action"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2026-2724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2724", "description": "Unlimited Elements for Elementor <=2.0.5 unauthenticated stored XSS via form field values", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["xss", "stored-xss", "unauthenticated", "elementor"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-2732-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_prepare_remove_background"}, {"name": "ARGS:attachment_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background GET handler allows Author+ to access arbitrary attachments", "method": "GET", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-2732-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_process_remove_background"}, {"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background POST handler allows Author+ to replace arbitrary attachments", "method": "POST", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-27326-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27326-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27333-01": {"ajax_action": "vmls_app", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls_app AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27333-02": {"ajax_action": "vmls", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27335-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27335-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27337-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27337-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27339-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27339-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27340-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27341-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27341-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27366-01": {"action": "init", "conditions": [{"name": "ARGS:mainwpsignature", "type": "exists"}, {"name": "ARGS:register", "type": "exists"}], "cve": "CVE-2026-27366", "description": "MainWP Child <=6.1.1 unauthenticated broken access control via site registration flow", "mode": "block", "severity": 7.5, "slug": "mainwp-child", "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-27379-01": {"ajax_action": "nxs_saveSiteSets", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_saveSiteSets AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27379-02": {"ajax_action": "nxs_snap_aj", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_snap_aj AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27384-01": {"ajax_action": "w3tc_dismiss_license_notice", "conditions": [{"name": "ARGS:notice_id", "type": "detectSQLi"}], "cve": "CVE-2026-27384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27384", "description": "W3 Total Cache <=2.9.1 authenticated SQL injection via notice_id in w3tc_dismiss_license_notice AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2026-27410-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via slimtrack AJAX tracker endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27410-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/slimstat/v1/hit(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via REST slimstat/v1/hit endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27421-01": {"ajax_action": "count_compare_items", "conditions": [{"name": "ARGS:compare_empty_text", "type": "regex", "value": "~(?:]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via count_compare_items \\u2013 blocks unauthenticated/low-priv requests containing XSS payloads in compare_empty_text echoed without escaping in includes/compare.php:621", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-02": {"ajax_action": "wpr_woo_grid_filters_ajax", "conditions": [{"name": "ARGS:grid_settings[/\\\\w+/]", "type": "regex", "value": "~(?:]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_woo_grid_filters_ajax \\u2013 blocks unauthenticated requests injecting XSS in grid_settings array values rendered without escaping in wpr-templates-data.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-03": {"ajax_action": "wpr_load_more_tweets", "conditions": [{"name": "ARGS:wpr_load_more_settings[/\\\\w+/]", "type": "regex", "value": "~(?:]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_load_more_tweets \\u2013 blocks unauthenticated requests injecting XSS in wpr_load_more_settings array values rendered without escaping in wpr-load-more-tweets.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27984-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:system|passthru|exec|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace|create_function|call_user_func|call_user_func_array|file_get_contents|file_put_contents|fopen|fwrite|include|require|phpinfo|unlink|rmdir|mail|header|curl_exec|base64_decode)[ ]*[(]~i"}], "cve": "CVE-2026-27984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27984", "description": "Widget Options <=4.1.3 authenticated code injection via widgetopts_ajax_validate_expression AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "widget-options", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": "<=4.1.3"}, "RULE-CVE-2026-27988-01": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-02": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-03": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin skin parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-04": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin file parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-05": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-06": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-28024-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28024-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28030-01": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-02": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-03": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-04": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-05": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (theme param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-06": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:product_id", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (product_id param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-07": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-08": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-09": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-10": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28039-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via table config language/column type setting (require_once with unsanitized path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via plugin settings language parameter (require_once with unsanitized wdtInterfaceLanguage)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-03": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-04": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart show engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-05": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 unauthenticated SSRF/LFI via cache update file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "unauthenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-06": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 SSRF/LFI via nested JSON roots file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28041-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28041-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28043-01": {"ajax_action": "healer_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|/proc/self)|\\\\.\\\\. %25(?:2[Ff]|5[Cc]))~i"}], "cve": "CVE-2026-28043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28043", "description": "Healer theme <=1.0.0 unauthenticated local file inclusion via healer_ajax_get_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "healer", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "php-stream-wrapper"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-28048-01": {"action": "init", "conditions": [{"name": "ARGS:flashtemplate", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28048", "description": "FlashMart Theme <=2.0.15 unauthenticated local file inclusion via template parameter", "mode": "block", "severity": 8.1, "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "core", "versions": ">=5.0"}, "RULE-CVE-2026-28049-01": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via template parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-02": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via page parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-03": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via file parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-04": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via include parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28117-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28117-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28118-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28118-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "nir-vana", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28119-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "nir-vana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28121-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28121-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28125-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28129-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28133-02": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~<[?%](?:php|=)~i"}], "cve": "CVE-2026-28133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28133", "description": "Filr Protection <=1.2.14 arbitrary file write via chunked upload (_chunkedd) in upload_file AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "filr-protection", "tags": ["arbitrary-file-upload", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=1.2.14"}, "RULE-CVE-2026-2826-01": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-2826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2826", "description": "Kadence Blocks <=3.6.4 missing authorization on kadence_import_process_pattern allows authenticated users without upload_files capability to import arbitrary content", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2026-2830-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2830-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:logid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via logid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2831-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:eventid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via eventid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2837-01": {"ajax_action": "ric_plugin_save_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2837", "description": "Ricerca Smart Search <=1.1.12 authenticated stored XSS via plugin settings in ric_plugin_save_settings", "mode": "block", "severity": 4.4, "slug": "ricerca-smart-search", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2026-2840-01": {"action": "init", "conditions": [{"name": "ARGS:eeb_mail", "type": "regex", "value": "~]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:~i"}], "cve": "CVE-2026-2840", "description": "Email Encoder Bundle <=2.4.4 reflected XSS via eeb_mail parameter in eeb_mailto shortcode", "mode": "block", "severity": 6.4, "slug": "email-encoder-bundle", "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-28557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpforo_synch_roles"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-28557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28557", "description": "wpForo Forum >=2.4.0 <2.4.16 missing authorization on wpforo_synch_roles AJAX handler allows privilege escalation via bulk usergroup-to-role reassignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control", "role-remapping"], "target": "plugin", "versions": ">=2.4.0 <2.4.16"}, "RULE-CVE-2026-28562-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-28562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28562", "description": "wpForo Forum >=2.4.0 <2.4.15 unauthenticated SQL injection via wpfob ORDER BY parameter", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": ">=2.4.0 <2.4.15"}, "RULE-CVE-2026-2868-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|admin-ajax)\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|]*\\\\son[a-z]+\\\\s*=|]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|]|]|])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute persisted via classic post save / admin-ajax", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|]*\\\\son[a-z]+\\\\s*=|]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|]|]|])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute through REST API post save", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2879-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/getgenie/v1/geniechat(?:/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2879", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2879", "description": "GetGenie <=4.3.2 authenticated (Author+) IDOR allows arbitrary post overwrite via id parameter in getgenie/v1/chat REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "getgenie", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-2890-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s+on[a-zA-Z]+=|]*>|javascript\\\\s*:|]*>|]*>|]*>|]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-2890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2890", "description": "Formidable Forms <=6.28 reflected/stored XSS via item_meta in form preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "formidable", "tags": ["xss", "unauthenticated", "reflected-xss"], "target": "plugin", "versions": "<=6.28"}, "RULE-CVE-2026-2918-01": {"ajax_action": "ha_condition_update", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\'] *on[a-z]+ *=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2918", "description": "Happy Elementor Addons <=3.21.0 IDOR + Stored XSS via ha_condition_update AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["idor", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-2924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|]|]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2924-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|]|]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2936-03": {"ajax_action": "today_traffic_index", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*>]*>.*?|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in today_traffic_index AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2936-04": {"ajax_action": "visits_time_graph", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*>]*>.*?|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in visits_time_graph AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2941-01": {"ajax_action": "linksy_search_and_replace_item_details", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "set"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_item_details allowing subscriber+ arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-02": {"ajax_action": "linksy_search_and_replace_replace_db", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_replace_db allowing subscriber+ bulk arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-03": {"ajax_action": "linksy_search_and_replace_fetch_db_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_fetch_db_list allowing subscriber+ database table enumeration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2942-01": {"ajax_action": "proSol_fileUploadProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2942-02": {"ajax_action": "proSol_fileUploadModalProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadModalProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2948-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-client/v2/import/images(?:[/?&]|$)~"}, {"name": "ARGS:imageUrl", "type": "regex", "value": "~^(?:ftp|file|dict|gopher|ssh|smtp|news|telnet|nntp|irc|imap|mongo):|^(?:https?:)?//(?:localhost|127\\\\.0\\\\.0\\\\.1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.169\\\\.254|0\\\\.0\\\\.0\\\\.0|/|[a-zA-Z]:\\\\\\\\|[a-zA-Z0-9.-]+\\\\.internal)~i"}], "cve": "CVE-2026-2948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2948", "description": "Gutenverse <=3.5.3 server-side request forgery via imageUrl in import_images REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2951-01": {"ajax_action": "gutentor_deactivate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_deactivate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-02": {"ajax_action": "gutentor_activate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_activate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-03": {"ajax_action": "gutentor_bulk_activate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_activate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-04": {"ajax_action": "gutentor_bulk_deactivate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_deactivate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2987-01": {"action": "init", "conditions": [{"name": "ARGS:sac_text", "type": "exists"}, {"name": "ARGS:sac_text", "type": "regex", "value": "~(?:]|]*on[a-z]+=|]*on(?:error|load)\\\\s*=|javascript\\\\s*:|]|]|]|on(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-2987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2987", "description": "Simple Ajax Chat <=20260217 unauthenticated stored XSS via chat message", "method": "POST", "mode": "block", "severity": 6.1, "slug": "simple-ajax-chat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=20260217"}, "RULE-CVE-2026-2993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:table", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 missing authorization on waic_* AJAX actions allows unauthenticated access to getListForTbl data endpoint", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["missing-authorization", "sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via orderby parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'[^\']*\'\\\\s*=\\\\s*\'[^\']*\'|\\\\b(?:OR|AND)\\\\s+1\\\\s*=\\\\s*1)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via search parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-3003-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vagaro_command", "type": "regex", "value": "~^(?:Add|Update)$~i"}, {"name": "ARGS:vagaro_code", "type": "regex", "value": "~(?:<(?:script|svg|math|embed|object)[^>]*|&#(?:0*60|x0*3c);?(?:script|svg|math|embed|object)|on[a-z]{3,16}[[:space:]]*=|javascript[[:space:]]*:|&#(?:0*106|x0*6a);?&#(?:0*97|x0*61);?&#(?:0*118|x0*76);?&#(?:0*97|x0*61);?&#(?:0*115|x0*73);?&#(?:0*99|x0*63);?&#(?:0*114|x0*72);?&#(?:0*105|x0*69);?&#(?:0*112|x0*70);?&#(?:0*116|x0*74);?[[:space:]]*:)~i"}], "cve": "CVE-2026-3003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3003", "description": "Vagaro Booking Widget <=0.3 unauthenticated stored XSS via vagaro_code on admin_init POST handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "vagaro-booking-widget", "tags": ["xss", "stored-xss", "unauthenticated", "admin-post"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-3018-01": {"ajax_action": "newsletters_api", "conditions": [{"name": "ARGS:wpmlsubscriber_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-3018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3018", "description": "Newsletters <=4.13 unauthenticated time-based SQL injection via wpmlsubscriber_id parameter in newsletters_api AJAX handler", "mode": "block", "severity": 7.5, "slug": "newsletters-lite", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-3056-01": {"ajax_action": "seraph_accel_api", "conditions": [{"name": "ARGS:fn", "type": "equals", "value": "LogClear"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3056", "description": "Seraphinite Accelerator <=2.28.14 missing authorization on LogClear via seraph_accel_api AJAX handler", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "seraph_accel_api"}, {"name": "ARGS:fn", "type": "equals", "value": "GetData"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3058", "description": "Seraphinite Accelerator <=2.28.14 unauthenticated sensitive information exposure via admin-post.php nopriv route with fn=GetData", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3090-01": {"ajax_action": "ps-get-email-logs", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:]+on[a-zA-Z]+[[:space:]]*=|javascript[[:space:]]*:)~i"}], "cve": "CVE-2026-3090", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3090", "description": "Post SMTP <=3.8.0 stored XSS via unescaped event_type rendering in ps-get-email-logs AJAX response", "method": "POST", "mode": "block", "severity": 7.2, "slug": "post-smtp", "tags": ["xss", "stored-xss", "ajax", "email-logs"], "target": "plugin", "versions": "<=3.8.0"}, "RULE-CVE-2026-3098-01": {"ajax_action": "smart-slider3", "conditions": [{"name": "ARGS:nextendcontroller", "type": "regex", "value": "~^sliders?$~i"}, {"name": "ARGS:nextendaction", "type": "regex", "value": "~^export~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3098", "description": "Smart Slider 3 <=3.5.1.33 arbitrary file read via export \\u2014 restricts slider export to admins only (blocks subscriber/editor-level exploitation)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "smart-slider-3", "tags": ["arbitrary-file-read", "lfi", "missing-authorization"], "target": "plugin", "versions": "<=3.5.1.33"}, "RULE-CVE-2026-3132-01": {"ajax_action": "jltma_widget_render_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_render_preview AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-02": {"ajax_action": "jltma_widget_save_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_save_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-03": {"ajax_action": "jltma_widget_get_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized data access via jltma_widget_get_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-04": {"ajax_action": "jltma_widget_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized widget deletion via jltma_widget_delete AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-05": {"ajax_action": "jltma_widget_update_category", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized category update via jltma_widget_update_category AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-06": {"ajax_action": "jltma_widget_get_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions read via jltma_widget_get_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-07": {"ajax_action": "jltma_widget_save_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions save via jltma_widget_save_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3138-01": {"ajax_action": "delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3138", "description": "Product Filter for WooCommerce by WBW <=3.1.2 missing authorization on delete AJAX handler allows unauthenticated filter data deletion", "mode": "block", "severity": 6.5, "slug": "woo-product-filter", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-3143-01": {"ajax_action": "boldgrid_cli_cancel_rollback", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-3143", "description": "Total Upkeep (boldgrid-backup) <=1.17.1 missing authorization on boldgrid_cli_cancel_rollback AJAX action allows unauthenticated rollback cancellation", "mode": "block", "severity": 5.3, "slug": "boldgrid-backup", "target": "plugin", "versions": "<=1.17.1"}, "RULE-CVE-2026-3178-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|<|>~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_name parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3178-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|<|>~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_description parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3180-01": {"ajax_action": "post_cg1l_resend_unconfirmed_mail_frontend", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg1l_resend_unconfirmed_mail_frontend", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-03": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordEmail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.3 unauthenticated SQL injection via cgLostPasswordEmail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.3"}, "RULE-CVE-2026-31921-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcpr(?:update|settings_update)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprupdate REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-31921-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcprsettings_update(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprsettings_update REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-3222-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:location_id", "type": "regex", "value": "~(?:UNION[^a-zA-Z]+(?:ALL[^a-zA-Z]+)?SELECT|(?:AND|OR)[^a-zA-Z]+(?:SLEEP|BENCHMARK|IF|CASE)[^a-zA-Z]*[(]|(?:AND|OR)[^a-zA-Z]+[0-9]+[^a-zA-Z]*=[^a-zA-Z]*[0-9]|SLEEP[^a-zA-Z]*[(]|BENCHMARK[^a-zA-Z]*[(])~i"}], "cve": "CVE-2026-3222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3222", "description": "WP Maps <=4.9.1 unauthenticated time-based blind SQL injection via location_id parameter in wpgmp_ajax_call AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-3226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/send-email(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3226", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3226", "description": "LearnPress <=4.3.2.8 missing authorization on SendEmailAjax REST endpoints allows Subscriber+ to trigger arbitrary email notifications", "method": "POST", "mode": "block", "severity": 4.3, "slug": "learnpress", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-3228-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:snapFB", "type": "regex", "value": "~(?:]|]|on(?:error|load|click|mouseover|focus)[ ]*=|javascript[ ]*:)~i"}], "cve": "CVE-2026-3228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3228", "description": "NextScripts: Social Networks Auto-Poster <=4.4.6 Stored XSS via snapFB post meta parameter during post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-32358-01": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_booking_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via date interval parameters in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-32358-02": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_modification_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via modification date interval parameter in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-3239-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-3239-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-32399-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[s] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[order] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-04": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[post_mime_type]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[post_mime_type] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32413-01": {"ajax_action": "pm_get_uri_editor", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe)[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 reflected XSS via post_id parameter in pm_get_uri_editor Gutenberg endpoint", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-02": {"ajax_action": "pm_bulk_tools", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_bulk_tools allows subscriber+ privilege escalation", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-03": {"ajax_action": "pm_detect_duplicates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_detect_duplicates allows subscriber+ data access", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32414-01": {"ajax_action": "awl-getRuleGroup", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getRuleGroup AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-02": {"ajax_action": "awl-getSuboptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSuboptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-03": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-04": {"ajax_action": "awl-changeLabelStatus", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-changeLabelStatus AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-05": {"ajax_action": "awl-showCurrentHooks", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-showCurrentHooks AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32423-01": {"ajax_action": "svg_get_attachment_url", "conditions": [{"name": "ARGS:attachmentID", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32423", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32423", "description": "Admin Site Enhancements <=8.4.0 missing authorization on svg_get_attachment_url allows contributor+ access to arbitrary attachment URLs", "method": "POST", "mode": "block", "severity": 5.4, "slug": "admin-site-enhancements", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=8.4.0"}, "RULE-CVE-2026-3243-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/amem/avatar/v1/crop(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via REST /amem/avatar/v1/crop leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-3243-02": {"ajax_action": "amem_avatar_crop", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via amem_avatar_crop AJAX handler leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "ajax"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-32441-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized comment export via catch_export_request on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32441-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized settings modification via catch_save_settings on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32459-01": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:order_by", "type": "regex", "value": "~[^a-zA-Z0-9_-]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via order_by parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-02": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:limit", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via limit parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-03": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via offset parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32461-01": {"ajax_action": "rsssl_force_confirm_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_force_confirm_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32461-02": {"ajax_action": "rsssl_resend_verification_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_resend_verification_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32484-03": {"ajax_action": "weforms_import_form", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:file_content", "type": "regex", "value": "~(?:O|C):\\\\d+:[^;]{0,256}[{\\"]~"}], "cve": "CVE-2026-32484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32484", "description": "weForms <=1.6.26 authenticated PHP object injection via form import in weforms_import_form AJAX handler", "mode": "block", "severity": 8.8, "slug": "weforms", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.6.26"}, "RULE-CVE-2026-32485-01": {"ajax_action": "wpuf_draft_post", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32485", "description": "WP User Frontend <=4.2.8 unauthenticated broken access control allows modifying arbitrary draft posts via wpuf_draft_post AJAX action with post_id parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-user-frontend", "tags": ["broken-access-control", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-32494-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via type parameter in admin notices", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32494-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:slider", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via slider parameter in admin actions page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32498-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32498", "description": "RegistrationMagic <=6.0.7.6 missing authorization on rm_options_default_payment_method AJAX handler allows authenticated users to modify payment settings", "mode": "block", "severity": 7.5, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.0.7.6"}, "RULE-CVE-2026-32499-01": {"action": "init", "conditions": [{"name": "ARGS:qc_bot_str_fields", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via qc_bot_str_fields on init hook", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32499-02": {"ajax_action": "wpbo_search_site", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via s parameter in wpbo_search_site AJAX handler", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32513-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2026-32513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32513", "description": "JS Archive List <=6.1.7 PHP Object Injection via serialized included/excluded widget settings", "mode": "block", "severity": 8.8, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-32517-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via s (search) parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:paged", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via paged parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "contact-manager-form"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via form-page parameters (id, name, description, etc.)", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via REQUEST_URI on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32520-01": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|shop_manager)~i"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member role parameter", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32520-02": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~wp_capabilities\\\\[~"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member wp_capabilities array injection", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32525-01": {"ajax_action": "jet_fb_ssr_validation_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[\\\\s\\"\',=:])(?:(?:system|exec|passthru|eval|assert|include|include_once|require|require_once)\\\\s*\\\\(|(?:shell_exec|popen|proc_open|pcntl_exec|create_function|call_user_func|call_user_func_array|unserialize|maybe_unserialize|file_get_contents|file_put_contents|fwrite|fopen|curl_exec|preg_replace_callback|array_map|array_filter|array_reduce|usort|uasort|uksort|array_walk|array_walk_recursive)(?:[\\\\s\\"\',;(]|$))~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation AJAX handler", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32525-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jet-form-builder/v1/validate-field(?:[/?]|$)~i"}, {"name": "ARGS:callable", "type": "regex", "value": "~^(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|assert|eval|create_function|call_user_func|call_user_func_array)$~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation REST endpoint", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32530-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/courses(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API course endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/quiz(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API quiz endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/migration(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API migration endpoint", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32532-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|]|]*onload\\\\s*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_username on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/register/?(?:\\\\?|$)~"}, {"name": "ARGS:signup_email", "type": "regex", "value": "~(?:]|]*onload\\\\s*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_email on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:]|/]|/)[^>]*onload(?:\\\\s|/)*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz comment field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:]|/]|/)[^>]*onload(?:\\\\s|/)*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz author field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:email", "type": "regex", "value": "~(?:]|/]|/)[^>]*onload(?:\\\\s|/)*=|]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz email field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32545-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+\\\\bonerror\\\\b|]+\\\\bonload\\\\b|])~i"}], "cve": "CVE-2026-32545", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32545", "description": "Taboola Pixel <=1.1.4 unauthenticated reflected XSS via front-end query parameters", "mode": "block", "severity": 7.1, "slug": "taboola-pixel", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-32546-01": {"action": "init", "conditions": [{"name": "ARGS:rcp_action", "type": "equals", "value": "toggle_auto_renew_off"}, {"name": "ARGS:membership_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-32546", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32546", "description": "Restrict Content <=3.2.22 unauthenticated membership auto-renew toggle via rcp_action parameter", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.2.22"}, "RULE-CVE-2026-32573-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nab/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\?(?:php)?|\\\\b(?:eval|assert|system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec)\\\\s*\\\\(|\\\\b(?:include|require)(?:_once)?\\\\s*\\\\(|`[^`]+`)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32573", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32573", "description": "Nelio A/B Testing <=8.2.7 authenticated (Editor+) remote code execution via PHP snippet scope rules on non-PHP experiment types", "method": "POST", "mode": "block", "severity": 9.1, "slug": "nelio-ab-testing", "tags": ["remote-code-execution", "code-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-3296-01": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (AJAX path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3296-02": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[form_id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (non-AJAX init path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3297-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3297-02": {"ajax_action": "pagelayer_save_templ_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_templ_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3300-01": {"action": "wp", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:[`]|\\\\$\\\\{|\\\\bsystem\\\\s*\\\\(|\\\\bexec\\\\s*\\\\(|\\\\bpassthru\\\\s*\\\\(|\\\\bshell_exec\\\\s*\\\\(|\\\\bpopen\\\\s*\\\\(|\\\\bproc_open\\\\s*\\\\(|\\\\beval\\\\s*\\\\(|\\\\bbase64_decode\\\\s*\\\\(|\\\\bfile_(?:get|put)_contents\\\\s*\\\\(|\\\\bcurl_exec\\\\s*\\\\()~i"}], "cve": "CVE-2026-3300", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3300", "description": "Everest Forms <=1.9.9 unauthenticated RCE via Calculation Addon process_filter() eval injection through form field values", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-3328-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[redirect]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[redirect] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_url]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_url] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[update_message]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[update_message] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_fields_save]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_fields_save] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3352-01": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3352-02": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_max_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_max_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3353-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/options\\\\.php(?:$|\\\\?)~"}, {"name": "ARGS:option_page", "type": "equals", "value": "csw-settings-group"}, {"name": "ARGS:csw_api_key", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|style|link|body|input|details|video|audio|source|math|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle|animationstart|animationend|animationiteration)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/[a-z+.\\\\-]+\\\\s*;\\\\s*base64|[\\"\'][\\\\s/]*on[a-z]+\\\\s*=|[\\"\']\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2026-3353", "description": "Comment SPAM Wiper <=1.2.1 authenticated (admin) stored XSS via csw_api_key option saved through WordPress Settings API", "mode": "block", "severity": 4.4, "slug": "comment-spam-wiper", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-3354-01": {"action": "admin_post_wikilookup_settings_form_response", "conditions": [{"name": "ARGS:popup_width", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-3354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3354", "description": "WikiLookup <=1.1.5 stored XSS via Popup Width setting in admin panel", "mode": "block", "severity": 4.4, "slug": "wikilookup", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-3360-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:tutor_action", "type": "equals", "value": "pay_incomplete_order"}, {"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-3360", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3360", "description": "Tutor LMS <=3.9.7 unauthenticated IDOR billing profile overwrite via pay_incomplete_order", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "unauthenticated", "data-tampering"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-3454-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/generateblocks/v1/dynamic-tag-replacements(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\{\\\\{\\\\s*(?:post_meta|post_title|post_excerpt|post_content|post_date|post_author|post_status|author_email)\\\\s[^}]*\\\\bid\\\\s*:\\\\s*[0-9]~i"}], "cve": "CVE-2026-3454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3454", "description": "GenerateBlocks <=2.2.0 IDOR information disclosure via dynamic tag id parameter in REST endpoint", "mode": "block", "severity": 6.5, "slug": "generateblocks", "tags": ["idor", "information-disclosure", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2026-3456-01": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS:attributekey", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\s+WHEN\\\\b)~i"}], "cve": "CVE-2026-3456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3456", "description": "GeekyBot <=1.2.0 unauthenticated SQL injection via attributekey in geekybot_ajax", "mode": "block", "severity": 7.5, "slug": "geeky-bot", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-3456-02": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS:attributekey", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\s+WHEN\\\\b)~i"}], "cve": "CVE-2026-3456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3456", "description": "GeekyBot <=1.2.0 unauthenticated SQL injection via attributekey in geekybot_frontendajax", "mode": "block", "severity": 7.5, "slug": "geeky-bot", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-3459-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~[*]~"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file upload via wildcard supported_type parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-upload", "unauthenticated", "file-type-validation"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3459-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~(?:^|,|[|])\\\\s*\\\\.?(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx)\\\\s*(?:,|[|]|$)~i"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file upload via dangerous extensions in supported_type", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-upload", "unauthenticated", "file-type-validation"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3459-03": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|/etc/passwd|(?:^|[\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)$)~i"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file deletion via path traversal in delete handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3464-01": {"ajax_action": "cuar_attach_file", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:/|\\\\\\\\)etc(?:/|\\\\\\\\)passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-3464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3464", "description": "WP Customer Area <=8.3.4 authenticated arbitrary file read/deletion via path traversal in cuar_attach_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "customer-area", "tags": ["path-traversal", "arbitrary-file-read", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2026-3464-02": {"ajax_action": "cuar_remove_attached_file", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:/|\\\\\\\\)etc(?:/|\\\\\\\\)passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-3464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3464", "description": "WP Customer Area <=8.3.4 authenticated arbitrary file deletion via path traversal in cuar_remove_attached_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "customer-area", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2026-3488-01": {"ajax_action": "wp_statistics_getPrivacyStatus", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3488", "description": "WP Statistics <=14.16.4 missing authorization on getPrivacyStatus AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-3488-02": {"ajax_action": "wp_statistics_updatePrivacyStatus", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3488", "description": "WP Statistics <=14.16.4 missing authorization on updatePrivacyStatus AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-34885-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[s]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|--\\\\s*$|[\'\\")0-9]\\\\s*#[\\\\s\\\\S]*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[s] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34885-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[mla_search_value]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|[\'\\")0-9]\\\\s*(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[mla_search_value] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34885-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|,[\\\\s/\\\\*]*\\\\([\\\\s/\\\\*]*SELECT[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|[\'\\")0-9]\\\\s*(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34886-01": {"ajax_action": "swpm_process_pp_smart_checkout", "conditions": [{"name": "ARGS:button_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 unauthenticated broken access control on PayPal smart checkout AJAX handler", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-34886-02": {"ajax_action": "swpm_stripe_sca_create_checkout_session", "conditions": [{"name": "ARGS:button_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 unauthenticated broken access control on Stripe SCA checkout session AJAX handler", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-34886-03": {"ajax_action": "swpm_reset_log_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 missing authorization on log reset AJAX handler allows subscriber+ log deletion", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-3489-01": {"ajax_action": "directorypress_handler_request", "conditions": [{"name": "ARGS:packages", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-3489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3489", "description": "DirectoryPress <=3.6.26 unauthenticated SQL injection via packages parameter in handler_request AJAX handler", "mode": "block", "severity": 7.5, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.26"}, "RULE-CVE-2026-34896-01": {"action": "admin_init", "conditions": [{"name": "ARGS:ucmm-review-dismiss", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34896", "description": "Under Construction, Coming Soon & Maintenance Mode <=2.1.1 CSRF via ucmm-review-dismiss parameter on admin_init \\u2014 blocks non-admin exploitation only (CSRF against admin victims is not WAF-coverable without header inspection)", "mode": "block", "severity": 7.5, "slug": "under-construction-maintenance-mode", "tags": ["csrf", "cross-site-request-forgery", "state-change"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-34900-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2026-34900", "description": "GiveWP <=4.14.2 unauthenticated reflected XSS via search parameter in donation_history shortcode", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.2"}, "RULE-CVE-2026-34902-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-34902", "description": "WooCommerce Product Table Lite <=4.6.3 unauthenticated reflected XSS via id parameter in wcpt_ajax", "mode": "block", "severity": 7.1, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-34902-02": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-34902", "description": "WooCommerce Product Table Lite <=4.6.3 unauthenticated reflected XSS via search parameter s in wcpt_ajax", "mode": "block", "severity": 7.1, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-34903-01": {"ajax_action": "oceanwp_cp_save_panel_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_panel_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-02": {"ajax_action": "oceanwp_cp_save_customizer_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_customizer_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-03": {"ajax_action": "oceanwp_cp_save_integrations_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_integrations_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-04": {"ajax_action": "oceanwp_cp_save_single_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_single_option AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-05": {"ajax_action": "oceanwp_cp_customizer_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_reset AJAX handler allows subscriber+ theme customizer settings reset", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-06": {"ajax_action": "oceanwp_cp_customizer_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_export AJAX handler allows subscriber+ theme customizer data export", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-07": {"ajax_action": "oceanwp_cp_customizer_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_import AJAX handler allows subscriber+ theme customizer data import via file parameter", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-08": {"ajax_action": "oceanwp_cp_child_theme_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_child_theme_install AJAX handler allows subscriber+ arbitrary file write via child theme install", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated", "file-write"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-09": {"ajax_action": "oceanwp_cp_system_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_system_status AJAX handler allows subscriber+ system information disclosure", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34904-01": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug set_option allows arbitrary options update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "options-update", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-34904-02": {"action": "admin_init", "conditions": [{"name": "ARGS:load_option_name", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug load_option allows arbitrary options read", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-34904-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wpb_clear_api_cache", "type": "equals", "value": "true"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug clear_cache allows unauthorized cache clearing", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-3498-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:blockart/(?:post-template|query-loop)[\\\\s\\\\S]{0,4000}?[\\"\\\\\\\\]clientId[\\"\\\\\\\\]\\\\s*:\\\\s*[\\"\\\\\\\\][^\\"\\\\\\\\]{0,2000}?(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|\\\\\\\\u003[cCeE]|&#x?(?:3[cCeE]|60|62);)~i"}], "cve": "CVE-2026-3498", "description": "BlockArt Blocks <=2.2.15 Author+ stored XSS via clientId attribute in blockart/post-template and blockart/query-loop blocks saved through WP core REST posts/pages endpoints", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "target": "plugin", "versions": "<=2.2.15"}, "RULE-CVE-2026-3498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:blockart/(?:post-template|query-loop)[\\\\s\\\\S]{0,4000}?[\\"\\\\\\\\]clientId[\\"\\\\\\\\]\\\\s*:\\\\s*[\\"\\\\\\\\][^\\"\\\\\\\\]{0,2000}?(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|\\\\\\\\u003[cCeE]|&#x?(?:3[cCeE]|60|62);)~i"}], "cve": "CVE-2026-3498", "description": "BlockArt Blocks <=2.2.15 Author+ stored XSS via clientId attribute submitted through classic editor admin-post path", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "target": "plugin", "versions": "<=2.2.15"}, "RULE-CVE-2026-3499-01": {"ajax_action": "adt_migrate_to_custom_post_type", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3499", "description": "Product Feed PRO for WooCommerce >=13.4.6 <=13.5.2.1 CSRF on adt_migrate_to_custom_post_type AJAX handler", "mode": "block", "severity": 8.8, "slug": "woo-product-feed-pro", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": ">=13.4.6 <=13.5.2.1"}, "RULE-CVE-2026-3499-02": {"ajax_action": "adt_clear_custom_attributes_product_meta_keys", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3499", "description": "Product Feed PRO for WooCommerce >=13.4.6 <=13.5.2.1 CSRF on adt_clear_custom_attributes_product_meta_keys AJAX handler", "mode": "block", "severity": 8.8, "slug": "woo-product-feed-pro", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": ">=13.4.6 <=13.5.2.1"}, "RULE-CVE-2026-3533-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "import_popup_action"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3533", "description": "JupiterX Core <=4.11.0 missing authorization on admin_action_import_popup_action allows low-privilege users to import arbitrary popup templates", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.11.0"}, "RULE-CVE-2026-3550-04": {"ajax_action": "rockpress_check_services", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3550", "description": "FT RockPress <=1.0.17 missing authorization on rockpress_check_services AJAX handler allows subscriber+ to perform system connection checks", "mode": "block", "severity": 5.3, "slug": "ft-rockpress", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.17"}, "RULE-CVE-2026-3577-01": {"ajax_action": "update_kbd_bkup_alias", "conditions": [{"name": "ARGS:val", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|embed|object)[\\\\s/>])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3577", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3577", "description": "Keep Backup Daily <=2.1.2 authenticated stored XSS via val parameter in update_kbd_bkup_alias AJAX handler", "mode": "block", "severity": 4.4, "slug": "keep-backup-daily", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2026-3584-01": {"ajax_action": "kaliforms_form_process", "conditions": [{"name": "ARGS:data[{entryCounter}]", "type": "regex", "value": "~^\\\\\\\\?(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|create_function|call_user_func|call_user_func_array|phpinfo|file_put_contents|file_get_contents|unlink|rmdir|mail|header|preg_replace)$~i"}], "cve": "CVE-2026-3584", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3584", "description": "Kali Forms <=2.4.9 unauthenticated RCE via placeholder overwrite in kaliforms_form_process using {entryCounter}", "method": "POST", "mode": "block", "severity": 9.8, "slug": "kali-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "callable-injection"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-3585-01": {"ajax_action": "tribe_aggregator_create_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|file\\\\s*://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3585", "description": "The Events Calendar <=6.15.17 authenticated (Author+) arbitrary file read via path traversal in tribe_aggregator_create_import AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.15.17"}, "RULE-CVE-2026-3585-02": {"ajax_action": "tribe_aggregator_create_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[^a-zA-Z0-9])|debug\\\\.log|(?:^|[\\\\\\\\/])error_log(?:$|[^a-zA-Z0-9]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3585", "description": "The Events Calendar <=6.15.17 authenticated (Author+) arbitrary file read via sensitive file path in tribe_aggregator_create_import AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.15.17"}, "RULE-CVE-2026-3589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc/store/v1/batch([/?&]|$)~i"}, {"name": "ARGS:requests[/\\\\d+/][path]", "type": "regex", "value": "~^/(?!wc/store[/?])~i"}], "cve": "CVE-2026-3589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3589", "description": "WooCommerce >=5.4.0 <=10.5.2 CSRF via Store API batch endpoint routing sub-requests to arbitrary non-Store REST endpoints. Covers both form-urlencoded and JSON body (application/json) POST variants via transparent JSON body parsing.", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woocommerce", "tags": ["csrf", "broken-access-control", "rest-api", "batch-route-hijack"], "target": "plugin", "versions": ">=5.4.0 <=10.5.2"}, "RULE-CVE-2026-3614-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:ctrl", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3614", "description": "AcyMailing 9.11.0-10.8.1 privilege escalation via acymailing_router AJAX to admin controller dispatch", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "ajax"], "target": "plugin", "versions": ">=9.11.0 <=10.8.1"}, "RULE-CVE-2026-3629-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 unauthenticated privilege escalation via wp_capabilities parameter during registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 authenticated privilege escalation via wp_capabilities parameter during profile update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp_capabilities[administrator]", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 privilege escalation via wp_capabilities bracket notation during registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:wp_capabilities[administrator]", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 privilege escalation via wp_capabilities bracket notation during profile update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3643-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/otm-ac/v1/update-widget-options(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3643", "description": "Accessibly <=3.0.3 unauthenticated stored XSS via REST API update-widget-options endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "otm-accessibly", "tags": ["xss", "stored", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.0.3"}, "RULE-CVE-2026-3655-01": {"ajax_action": "lwp_ajax_register", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "lwp_ajax_register"}, {"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:idToken", "type": "regex", "value": "/^eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.[A-Za-z0-9_\\\\-]{10,}$/"}], "cve": "CVE-2026-3655", "description": "Login With Phone Number >=1.8.50 <=1.8.60 unauthenticated authentication bypass via lwp_ajax_register Firebase phone binding flaw", "mode": "block", "severity": 9.8, "slug": "login-with-phone-number", "target": "plugin", "versions": ">=1.8.50 <=1.8.60"}, "RULE-CVE-2026-3655-02": {"ajax_action": "lwp_ajax_login", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "lwp_ajax_login"}, {"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:idToken", "type": "regex", "value": "/^eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.[A-Za-z0-9_\\\\-]{10,}$/"}], "cve": "CVE-2026-3655", "description": "Login With Phone Number >=1.8.50 <=1.8.60 unauthenticated authentication bypass via lwp_ajax_login Firebase phone binding flaw", "mode": "block", "severity": 9.8, "slug": "login-with-phone-number", "target": "plugin", "versions": ">=1.8.50 <=1.8.60"}, "RULE-CVE-2026-3657-01": {"ajax_action": "stickymenu_contact_lead_form", "conditions": [{"name": "ARGS:save_form_lead", "type": "exists"}, {"name": "ARGS:/.*(?:`|\'|\\"|[(]|;|--).*/", "type": "exists"}], "cve": "CVE-2026-3657", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3657", "description": "myStickymenu <=2.8.6 unauthenticated SQL injection via crafted POST parameter names in stickymenu_contact_lead_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "mystickymenu", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2026-3658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via orderby parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via order parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via search parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:filter", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via filter parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3718-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:MWP-Key-Name", "type": "regex", "value": "~(?:]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:|svg\\\\s*onload|body\\\\s*onload)~i"}], "cve": "CVE-2026-3718", "description": "Worker <=4.9.31 stored XSS via MWP-Key-Name HTTP header", "mode": "block", "severity": 7.2, "slug": "worker", "target": "plugin", "versions": "<=4.9.31"}, "RULE-CVE-2026-3722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_wp_attachment_image_alt", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via _wp_attachment_image_alt on attachment edit", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3722-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via post_title on attachment edit", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3722-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "ARGS:alt_text", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via REST API alt_text on media update", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3772-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/plugins\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^wpeditor_plugin$~i"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:^|/)(?:wp-content/plugins/[^?&#]+\\\\.php|[^/]+\\\\.php)$~i"}, {"name": "ARGS:new-content", "type": "regex", "value": "~(?:]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|base64_decode|assert)\\\\s*\\\\()~i"}], "cve": "CVE-2026-3772", "description": "WP Editor <=1.2.9.2 CSRF in add_plugins_page allows unauthenticated attackers to overwrite plugin PHP files via forged request", "mode": "block", "severity": 8.8, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9.2"}, "RULE-CVE-2026-3772-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/themes\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^wpeditor_themes$~i"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:^|/)(?:wp-content/themes/[^?&#]+\\\\.php|[^/]+\\\\.php)$~i"}, {"name": "ARGS:new-content", "type": "regex", "value": "~(?:]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|base64_decode|assert)\\\\s*\\\\()~i"}], "cve": "CVE-2026-3772", "description": "WP Editor <=1.2.9.2 CSRF in add_themes_page allows unauthenticated attackers to overwrite theme PHP files via forged request", "mode": "block", "severity": 8.8, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9.2"}, "RULE-CVE-2026-3844-01": {"ajax_action": "save_settings_tab_basic", "conditions": [{"name": "ARGS:breeze-store-gravatars-locally", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block enabling \'Host Files Locally Gravatars\' setting (defense in depth; prevents activating the vulnerable code path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "configuration-block"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3844-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:wp-comments-post\\\\.php(?:\\\\?|$)|(?:index\\\\.php\\\\?rest_route=/)?wp(?:-json)?/wp/v2/comments(?:/|\\\\?|$))~"}, {"name": "ARGS:/^(?:author|email|url|author_name|author_email|author_url|comment_author(?:_email|_url)?)$/", "type": "regex", "value": "~\\\\bsrc(?:set)?\\\\s*=\\\\s*[\\"\']?\\\\s*https?://[^\\\\s\\"\'<>]{1,500}\\\\.(?:php[3-8s]?|phtml|phar|pht|inc|phps|jsp|aspx?|cgi|pl|py|rb|sh|exe|htaccess)(?:[?#/\\\\s\\"\'&]|$)~i"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block comment submission carrying src/srcset payload pointing to executable extension (Stage 1; attacker seeds malicious gravatar URL via author fields, which Breeze\'s loose regex extracts and fetches)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "server-side-fetch"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3844-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:wp-comments-post\\\\.php(?:\\\\?|$)|(?:index\\\\.php\\\\?rest_route=/)?wp(?:-json)?/wp/v2/comments(?:/|\\\\?|$))~"}, {"name": "ARGS:srcset", "type": "regex", "value": "~^\\\\s*https?://~i"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block a structurally-suspicious standalone POST\\nfield carrying an http(s):// URL on comment-submission endpoints. Native\\nWordPress comment forms do not POST this field, so its presence with a\\nURL value is consistent only with attacker-driven URL injection aimed at\\ncircumventing RULE-02\'s named-field allowlist. The plugin\'s URL extractor\\nscans the entire POST array, so this rule covers fields outside RULE-02\'s\\nsource set.\\n", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "server-side-fetch", "bypass-fix"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3875-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[betterdocs_feedback_form\\\\s[^\\\\]]*(?:on(?:error|load|mouseover|click|focus|blur)\\\\s*=|]|javascript\\\\s*:|\\\\\\"\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3875", "description": "BetterDocs <=4.3.8 contributor+ stored XSS via betterdocs_feedback_form shortcode attributes", "mode": "block", "slug": "betterdocs", "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2026-3876-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[prismatic_encoded\\\\b[^\\\\]]*(?:on(?:mouse(?:over|out|down|up|move|enter|leave)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select|abort|unload|resize|scroll|beforeunload|hashchange|pointerover|pointerenter|animationend|transitionend)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2026-3876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3876", "description": "Prismatic <=3.7.3 unauthenticated stored XSS via prismatic_encoded pseudo-shortcode in comment body", "method": "POST", "mode": "block", "severity": 7.2, "slug": "prismatic", "tags": ["xss", "stored", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39432-01": {"ajax_action": "dismiss_woocommerce_notice", "conditions": [{"name": "ARGS:notice_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39432", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39432", "description": "Timetics <=1.0.53 broken access control on dismiss_woocommerce_notice allows subscriber+ users to dismiss admin notices", "method": "POST", "mode": "block", "severity": 8.2, "slug": "timetics", "tags": ["broken-access-control", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.53"}, "RULE-CVE-2026-39432-02": {"ajax_action": "wpmet-notices", "conditions": [{"name": "ARGS:notice_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39432", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39432", "description": "Timetics <=1.0.53 broken access control on wpmet-notices allows authenticated users to dismiss plugin notices", "method": "POST", "mode": "block", "severity": 8.2, "slug": "timetics", "tags": ["broken-access-control", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.53"}, "RULE-CVE-2026-39437-01": {"ajax_action": "alg_wc_pq_update_price_by_qty", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_price_by_qty AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39437-02": {"ajax_action": "alg_wc_pq_update_get_dropdown_options", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_get_dropdown_options AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39437-03": {"ajax_action": "alg_wc_pq_update_get_input_options", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_get_input_options AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:feed[=/]kuantokusta(?:[/?]|$)|[?&]feed=kuantokusta(?:&|$))~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:%20|\\\\+|%2520)(?:UNION|SELECT|FROM|WHERE|INSERT|UPDATE|DELETE|DROP|ALTER)(?:%20|\\\\+|%2520)|UNION%20SELECT|UNION\\\\+SELECT|--|%2D%2D|%252D%252D|information_schema|wp_users|0x[0-9a-fA-F]+)~i"}], "cve": "CVE-2026-39441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39441", "description": "Feed KuantoKusta for WooCommerce <=5.3 unauthenticated SQL injection via public kuantokusta product feed endpoint", "mode": "block", "severity": 9.3, "slug": "feed-kuantokusta-for-woocommerce", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=5.3"}, "RULE-CVE-2026-39450-01": {"ajax_action": "bwfan_update_automation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_update_automation AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39450-02": {"ajax_action": "bwfan_toggle_automation_state", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_toggle_automation_state AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39450-03": {"ajax_action": "bwfan_automation_submit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_automation_submit AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39464-01": {"ajax_action": "seedprod_lite_v2_import_theme_request", "conditions": [{"name": "ARGS:theme_url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.)|^https?://(?:0\\\\.)|^https?://(?:10\\\\.)|^https?://(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|^https?://(?:192\\\\.168\\\\.)|^https?://(?:169\\\\.254\\\\.)|^https?://localhost\\\\b|^https?://\\\\[::1\\\\]|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2026-39464", "description": "SeedProd Coming Soon <=6.19.8 authenticated SSRF via theme_url in seedprod_lite_v2_import_theme_request", "mode": "block", "severity": 5.5, "slug": "coming-soon", "target": "plugin", "versions": "<=6.19.8"}, "RULE-CVE-2026-39464-02": {"ajax_action": "seedprod_lite_v2_import_theme_by_url", "conditions": [{"name": "ARGS:theme_url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.)|^https?://(?:0\\\\.)|^https?://(?:10\\\\.)|^https?://(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|^https?://(?:192\\\\.168\\\\.)|^https?://(?:169\\\\.254\\\\.)|^https?://localhost\\\\b|^https?://\\\\[::1\\\\]|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2026-39464", "description": "SeedProd Coming Soon <=6.19.8 authenticated SSRF via theme_url in seedprod_lite_v2_import_theme_by_url", "mode": "block", "severity": 5.5, "slug": "coming-soon", "target": "plugin", "versions": "<=6.19.8"}, "RULE-CVE-2026-39466-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blc_local"}, {"name": "ARGS:filter_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via filter_id parameter on links page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39466-02": {"ajax_action": "blc_link_details", "conditions": [{"name": "ARGS:link_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via link_id in blc_link_details AJAX handler", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39466-03": {"ajax_action": "blc_discard", "conditions": [{"name": "ARGS:link_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via link_id in blc_discard AJAX handler", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39468-01": {"ajax_action": "rwmb_delete_file", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39468", "description": "Meta Box <=5.11.1 contributor+ arbitrary file deletion via rwmb_delete_file AJAX handler (missing authorization + path traversal)", "mode": "block", "severity": 6.8, "slug": "meta-box", "target": "plugin", "versions": "<=5.11.1"}, "RULE-CVE-2026-39470-01": {"ajax_action": "cart_abandonment_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39470", "description": "Block unauthenticated/low-privilege plugin installation via cart_abandonment_install_plugin AJAX handler (CWE-266 Privilege Escalation)", "mode": "block", "severity": 7.2, "slug": "woo-cart-abandonment-recovery", "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2026-39470-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "wcar_rollback"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39470", "description": "Block unauthenticated/low-privilege rollback via admin_post_wcar_rollback (CWE-266 Privilege Escalation)", "mode": "block", "severity": 7.2, "slug": "woo-cart-abandonment-recovery", "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2026-39475-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via orderby parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via order parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|\'\\\\s*(?:OR|AND)\\\\s+\\\\(?SELECT\\\\b)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via search parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39479-01": {"action": "admin_init", "conditions": [{"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via status_filter parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-02": {"action": "admin_init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via orderby parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-03": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b|[^A-Z](?:ASC|DESC)[^A-Z].*(?:ASC|DESC|SELECT|SLEEP|BENCHMARK))~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via order parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39480-01": {"ajax_action": "bmip_auth_handshake", "conditions": [{"name": "ARGS:challenge", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39480", "description": "Backup Migration <=2.1.1 unauthenticated sensitive data exposure via bmip_auth_handshake AJAX endpoint", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-39481-01": {"ajax_action": "modula_add_images_ids", "conditions": [{"name": "ARGS:modula_images", "type": "exists"}, {"name": "ARGS:modula_images", "type": "regex", "value": "~(?:O:\\\\d+:\\"|s:\\\\d+:\\\\\\\\?\\"|a:\\\\d+:\\\\{|C:\\\\d+:\\"|r:\\\\d+;)~"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39481", "description": "Block PHP Object Injection via modula_images parameter in Modula Image Gallery AJAX import handler for users lacking upload_files capability", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.14.18"}, "RULE-CVE-2026-39486-01": {"ajax_action": "dlm_db_log_entries", "conditions": [{"name": "ARGS:dlm_log_orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_db_log_entries AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-02": {"ajax_action": "dlm_alter_download_log", "conditions": [{"name": "ARGS:dlm_upgrade_db", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_alter_download_log AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-03": {"ajax_action": "download_monitor_list_files", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via download_monitor_list_files orderby parameter", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39491-01": {"ajax_action": "jupiterx_custom_snippets", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_custom_snippets AJAX handler (title/content/snippet_code)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-02": {"ajax_action": "jupiterx_layout_builder", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_layout_builder AJAX handler (title/layout_data/conditions)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-03": {"ajax_action": "raven_form_frontend", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 stored XSS via raven_form_frontend AJAX handler (fields) - also nopriv", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39493-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|CONCAT\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39493", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated SQL injection via ssa/v1 REST API", "mode": "block", "severity": 9.3, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39495", "description": "Simply Schedule Appointments <=1.6.9.27 authenticated (Contributor+) SQL injection via REST API", "mode": "block", "severity": 8.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39497-01": {"ajax_action": "woocs_recalculate_order_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_order_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-02": {"ajax_action": "woocs_recalculate_orders_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_orders_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-03": {"ajax_action": "woocs_update_order_rate", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_update_order_rate AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-04": {"ajax_action": "woocs_all_order_ids", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_all_order_ids AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-05": {"ajax_action": "woocs_stat_redraw", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_stat_redraw AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39498-01": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_templates AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import templates endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39498-02": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_state AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import state endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39499-01": {"ajax_action": "wapf_search_products", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39499", "description": "Advanced Product Fields for WooCommerce <=1.6.19 authenticated (Shop Manager+) PHP Object Injection via q parameter in wapf_search_products AJAX handler", "mode": "block", "severity": 7.2, "slug": "advanced-product-fields-for-woocommerce", "target": "plugin", "versions": "<=1.6.19"}, "RULE-CVE-2026-39511-01": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-album", "type": "regex", "value": "~[^0-9\\\\-]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-album parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-02": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-page", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-page parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-03": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-tag", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-tag parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-04": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-search parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39531-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_ne", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_ne parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_sw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_sw parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-03": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via dynamic search field parameters", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39533-01": {"ajax_action": "awpcp_create_empty_listing", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing creation via awpcp_create_empty_listing AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-02": {"ajax_action": "awpcp_save_listing_information", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing modification via awpcp_save_listing_information AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-03": {"ajax_action": "awpcp_update_listing_order", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing order update via awpcp_update_listing_order AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-04": {"ajax_action": "awpcp_update_submit_listing_sections", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing section update via awpcp_update_submit_listing_sections AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39579-01": {"ajax_action": "bblocks_api_keys", "conditions": [{"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39579", "description": "B Blocks <=2.0.31 contributor+ privilege escalation via bblocks_api_keys AJAX handler missing capability check", "mode": "block", "severity": 8.8, "slug": "b-blocks", "target": "plugin", "versions": "<=2.0.31"}, "RULE-CVE-2026-39581-01": {"ajax_action": "activitytime_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-02": {"ajax_action": "activitytime_mvc_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_mvc_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitytime/v1/action(?:/|\\\\?|$)~"}, {"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in REST API activitytime/v1/action endpoint", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39587-01": {"ajax_action": "app_ajax_register", "conditions": [{"name": "ARGS:role", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2026-39587", "description": "Block unauthenticated privilege escalation via app_ajax_register AJAX action in WP BASE Booking plugin <= 5.9.0. Attacker can register a user with an arbitrary role (e.g., administrator) through the unprotected registration handler.", "mode": "block", "severity": 8.1, "slug": "wp-base-booking-of-appointments-services-and-events", "target": "plugin", "versions": "<=5.9.0"}, "RULE-CVE-2026-39591-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via upload.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/uploadFile\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via uploadFile.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload(?:File)?\\\\.php~i"}, {"name": "ARGS:_target", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|[\\\\/]etc[\\\\/]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ path traversal via _target parameter in upload helpers", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39597-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 unauthenticated reflected XSS via posts_data JSON blob in wpz_posts_grid_load_more AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-02": {"ajax_action": "get_content_from_elementor_export_file", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:]|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via filename parameter (javascript protocol bypass) in get_content_from_elementor_export_file AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-03": {"ajax_action": "get_wpzoom_preview", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|style\\\\s*=)|]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via url parameter attribute breakout in get_wpzoom_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39619-01": {"ajax_action": "busiprof_install_activate_plugin", "conditions": [{"name": "ARGS:plugin_url", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39619", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39619", "description": "Busiprof <=2.5.2 CSRF to arbitrary plugin install/web shell upload via busiprof_install_activate_plugin AJAX handler", "mode": "block", "severity": 9.6, "slug": "busiprof", "tags": ["csrf", "arbitrary-file-upload", "web-shell", "missing-authorization"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2026-39656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_direct_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_direct_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_reverse_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_reverse_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_settlement_change"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_settlement_change", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_payment_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_payment_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39665-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php\\\\?page=sfi_settings~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39665", "description": "SEO Image <=3.0.5 reflected XSS via REQUEST_URI in admin settings page", "mode": "block", "severity": 6.5, "slug": "seo-image", "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-3985-01": {"ajax_action": "ce4wp_abandoned_checkouts_capture_guest_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3985-02": {"ajax_action": "ce4wp_abandoned_checkouts_no_consent_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3986-01": {"action": "admin_init", "conditions": [{"name": "ARGS:form_structure", "type": "regex", "value": "~(?:]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]|]|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3986", "description": "Calculated Fields Form <=5.4.5.0 authenticated (Contributor+) stored XSS via form_structure parameter containing unsanitized fcontent in fhtml field types", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calculated-fields-form", "tags": ["xss", "stored", "authenticated", "insufficient-sanitization"], "target": "plugin", "versions": "<=5.4.5.0"}, "RULE-CVE-2026-4021-01": {"ajax_action": "post_cg1l_login_user_by_key", "conditions": [{"name": "ARGS:cglKey", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4021", "description": "Contest Gallery <=28.1.5 unauthenticated account takeover via post_cg1l_login_user_by_key AJAX action (key-based login after type-confusion activation key overwrite)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=28.1.5"}, "RULE-CVE-2026-4024-01": {"ajax_action": "wpr_update_form_action_meta", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4024", "description": "Royal Elementor Addons <= 1.7.1056 - Unauthenticated Missing Authorization via wpr_update_form_action_meta (post-meta write with publicly-exposed nonce)", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-4029-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-db-backup"}, {"name": "ARGS:action", "type": "equals", "value": "backup"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2026-4029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4029", "description": "WP-DB-Backup <=2.5.2 unauthenticated backup export via admin menu in Multisite", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-01": {"ajax_action": "save_backup_time", "conditions": [{"name": "ARGS:location", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows arbitrary file deletion via location parameter path traversal", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-02": {"action": "init", "conditions": [{"name": "ARGS:via", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on init hook allows arbitrary file read via via parameter path traversal in Multisite", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4031-02": {"ajax_action": "save_backup_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:backup-time", "type": "exists"}], "cve": "CVE-2026-4031", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows subscriber+ schedule manipulation", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4056-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/user-registration/v1/content-access-rules(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4056", "description": "User Registration & Membership <=5.1.4 missing authorization on Content Access Rules REST API allows Contributor+ to create/read/update/delete/toggle/duplicate content restriction rules", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-4059-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[woolentor_quickview_button[^\\\\]]*button_text\\\\s*=\\\\s*(?:\\"|"|"|\')[^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4059", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4059", "description": "ShopLentor <=3.3.5 Contributor+ stored XSS via woolentor_quickview_button shortcode button_text attribute", "mode": "block", "severity": 6.4, "slug": "woolentor-addons", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2026-4060-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via sort parameter in AJAX query", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4060-02": {"action": "init", "conditions": [{"name": "ARGS:gm_sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via gm_sort front-end parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4061-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:map_post_type", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-4061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4061", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via map_post_type parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:exclude_object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via exclude_object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids query var in template_redirect handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4066-01": {"ajax_action": "smart-cf-relational-posts-search", "conditions": [{"name": "ARGS:post_types", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-4066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4066", "description": "Smart Custom Fields <=5.0.6 missing per-post authorization in relational posts search allows authenticated users with read capability to enumerate private and draft posts", "mode": "block", "severity": 4.3, "slug": "smart-custom-fields", "tags": ["missing-authorization", "information-disclosure", "ajax"], "target": "plugin", "versions": "<=5.0.6"}, "RULE-CVE-2026-40727-01": {"ajax_action": "bulk_action_listener", "conditions": [{"name": "ARGS:action", "type": "exists"}, {"name": "ARGS:imported", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40727", "description": "Groundhogg <= 4.4 \\u2014 Missing Authorization on Imported File Deletion via bulk_action_listener AJAX (CWE-862)", "mode": "block", "severity": 7.7, "slug": "groundhogg", "target": "plugin", "versions": "<4.4.1"}, "RULE-CVE-2026-40744-01": {"ajax_action": "fl_builder_export_templates_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40744", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40744", "description": "Beaver Builder <=2.10.1.2 authenticated SQL injection via fl_builder_export_templates_data AJAX handler", "mode": "block", "severity": 8.5, "slug": "beaver-builder-lite-version", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=2.10.1.2"}, "RULE-CVE-2026-40745-01": {"ajax_action": "elementpack_dynamic_select_input_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"\']?\\\\d)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-40745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40745", "description": "Element Pack Elementor Addons <=8.4.2 authenticated blind SQL injection via elementpack_dynamic_select_input_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "bdthemes-element-pack-lite", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-4075-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-4075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-40764-01": {"ajax_action": "wpforms_admin_forms_overview_save_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on save_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-02": {"ajax_action": "wpforms_admin_forms_overview_delete_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on delete_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-03": {"ajax_action": "wpforms_update_lite_connect_enabled_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on update_lite_connect_enabled_setting \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-04": {"ajax_action": "wpforms_lite_connect_finalize", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on lite_connect_finalize \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-05": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 missing capability check on lite_settings_upgrade AJAX handler", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40765-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-40765", "description": "Collect.chat <=2.4.9 reflected XSS via REQUEST_URI in admin notice (esc_url bypass)", "mode": "block", "severity": 7.1, "slug": "collectchat", "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-40768-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:fix_booking_id", "type": "regex", "value": "~^[0-9]+$~"}, {"name": "ARGS:new_status", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-40768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40768", "description": "Salon Booking System <=10.30.24 unauthenticated IDOR booking modification via fix_booking_id + new_status on wp_ajax_nopriv_salon (CWE-639)", "mode": "block", "severity": 7.3, "slug": "salon-booking-system", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=10.30.24"}, "RULE-CVE-2026-40769-01": {"ajax_action": "cfefd_remove_file", "conditions": [{"name": "ARGS:file_name", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|^/|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|wp-settings\\\\.php|debug\\\\.log))~i"}], "cve": "CVE-2026-40769", "description": "Contact Form Extender for Divi <=1.0.6 unauthenticated arbitrary file deletion via path traversal in file_name parameter", "mode": "block", "severity": 8.6, "slug": "contact-form-extender-for-divi-builder", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-40771-01": {"ajax_action": "post_cg_galleries_show_cg_gallery", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_galleries_show_cg_gallery AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40771-02": {"ajax_action": "post_cg_load_v10", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_load_v10 AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40779-01": {"action": "save_link_library_moderate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40779", "description": "Link Library <=7.8.8 contributor+ arbitrary file deletion via admin_post_save_link_library_moderate (missing capability check on moderation handler)", "mode": "block", "severity": 7.7, "slug": "link-library", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=7.8.8"}, "RULE-CVE-2026-40780-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v[0-9]+/(?:[^/]*(?:password|reset|recover|forgot|auth)[^/]*)(?:/|\\\\?|$)~i"}, {"name": "ARGS:email", "type": "regex", "value": "~.+@.+~"}], "cve": "CVE-2026-40780", "description": "BookIt <2.5.4.1 unauthenticated authentication bypass via REST API password recovery exploitation", "mode": "block", "severity": 7.5, "slug": "bookit", "target": "plugin", "versions": "<2.5.4.1"}, "RULE-CVE-2026-40784-01": {"ajax_action": "fluentform_fluent_board_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40784", "description": "FluentBoards <=1.91.2 IDOR via fluentform_fluent_board_config AJAX handler missing authorization", "mode": "block", "severity": 8.1, "slug": "fluent-boards", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.91.2"}, "RULE-CVE-2026-40787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quiz/(?:save_quiz|create_quiz)~"}, {"name": "ARGS:quiz_name", "type": "exists"}, {"name": "ARGS:quiz_name", "type": "regex", "value": "~(?:<[a-z/!?]|[\\"\']\\\\s*(?:on[a-z]+=|style\\\\s*=|xmlns)|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40787", "description": "Stored XSS in Quiz And Survey Master <= 11.0.0 via quiz name/description fields in REST API save_quiz/create_quiz endpoints \\u2014 blocks HTML/script injection patterns in quiz_name parameter for users lacking manage_options", "mode": "block", "severity": 7.1, "slug": "quiz-master-next", "target": "plugin", "versions": "<=11.0.0"}, "RULE-CVE-2026-40791-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:from_email", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via from_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40791-02": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:test_email", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via test_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40797-01": {"ajax_action": "date_change_on_no", "conditions": [{"name": "ARGS:wi_webinar_id_resend_mail", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via wi_webinar_id_resend_mail in date_change_on_no AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-02": {"ajax_action": "webinarignition_broadcast_msg_poll", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via id in webinarignition_broadcast_msg_poll AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-03": {"ajax_action": "webinarignition_send_email_verification_code", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via email in webinarignition_send_email_verification_code AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40798-01": {"ajax_action": "wpforo_tag_search", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\'\\\\s*(?:AND|OR)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\'\\\\s*(?:AND|OR)\\\\s+.*(?:SELECT|UNION|CONCAT|VERSION|DATABASE))~i"}], "cve": "CVE-2026-40798", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40798", "description": "wpForo Forum <=3.0.4 unauthenticated SQL injection via q parameter in wpforo_tag_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-4094-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woocs_reset", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4094", "description": "FOX Currency Switcher <=1.4.5 missing authorization allows authenticated users to delete plugin configuration via woocs_reset parameter on admin pages", "mode": "block", "severity": 8.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-4100-02": {"ajax_action": "pmpro_stripe_delete_webhook", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^pmpro_stripe_delete_webhook$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4100", "description": "Paid Memberships Pro <=3.6.5 missing authorization on pmpro_stripe_delete_webhook allows authenticated Subscriber+ users to delete Stripe webhooks and disrupt payment processing", "mode": "block", "severity": 7.1, "slug": "paid-memberships-pro", "tags": ["missing-authorization", "service-disruption"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-4127-01": {"ajax_action": "speedup01_enabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_enabled allows subscriber+ to toggle optimization settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "speedup-optimization", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4127-02": {"ajax_action": "speedup01_purge_all", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_purge_all allows subscriber+ to purge all cache files", "method": "POST", "mode": "block", "severity": 7.5, "slug": "speedup-optimization", "tags": ["missing-authorization", "cache-purge", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4143-01": {"ajax_action": "fakturama", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4143", "description": "Neos Connector for Fakturama <=0.0.14 fully unprotected AJAX handler allows CSRF via wp_ajax_fakturama", "mode": "block", "severity": 4.3, "slug": "neos-connector-for-fakturama", "target": "plugin", "versions": "<=0.0.14"}, "RULE-CVE-2026-4146-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=loco-version(?:&|$)~"}, {"name": "ARGS:update_href", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:[^,]*(?:text/html|base64)|[\\"\'><]|on(?:error|load|click|mouseover|focus)\\\\s*=|%(?:22|27|3[CEce]))~i"}], "cve": "CVE-2026-4146", "description": "Loco Translate <=2.8.2 reflected XSS via update_href parameter on admin version page", "mode": "block", "severity": 6.1, "slug": "loco-translate", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2026-42379-04": {"ajax_action": "templately_save_conditions", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "templately_save_conditions"}, {"name": "ARGS:conditions", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42379", "description": "Templately <=3.6.1 unauthorized condition saving via templately_save_conditions AJAX handler missing capability check", "mode": "block", "severity": 7.7, "slug": "templately", "tags": ["missing-authorization", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-42384-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/(?:debug|logs?)(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42384", "description": "Simply Schedule Appointments <1.6.11.2 unauthenticated debug log exposure via REST API (ssa/v1 debug endpoint)", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "target": "plugin", "versions": "<1.6.11.2"}, "RULE-CVE-2026-4248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\{usermeta:[^}]*(?:password_reset_link|user_pass|session_tokens|user_activation_key)[^}]*\\\\}~i"}], "cve": "CVE-2026-4248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4248", "description": "Ultimate Member <=2.11.2 authenticated (Contributor+) sensitive usermeta disclosure via {usermeta:} placeholder in post content", "method": "POST", "mode": "block", "severity": 8.0, "slug": "ultimate-member", "tags": ["insecure-direct-object-reference", "sensitive-data-exposure", "stored-content"], "target": "plugin", "versions": "<=2.11.2"}, "RULE-CVE-2026-4261-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:on_expire_default_to_role", "type": "regex", "value": "~^(?i)(?:administrator|editor|author|contributor)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4261", "description": "Expire Users <=1.2.2 authenticated privilege escalation via profile on_expire_default_to_role parameter", "mode": "block", "severity": 8.8, "slug": "expire-users", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-42649-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "favicon-rotator"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc](?:script|svg|img|iframe|object|embed|body)|(?:^|[^a-z])on(?:error|load|focus|click|mouseover|blur)(?:%3[Dd]|\\\\s*=)|javascript(?:%3[Aa]|\\\\s*:)|<(?:script|svg|img|iframe|object|embed|body)[\\\\s/>])~i"}], "cve": "CVE-2026-42649", "description": "Favicon Rotator <=1.2.11 unauthenticated reflected XSS via unsanitized REQUEST_URI on admin settings page", "mode": "block", "severity": 7.1, "slug": "favicon-rotator", "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2026-42650-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-03": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-04": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42652-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "user-registration-membership-payment-history"}, {"name": "ARGS:action", "type": "regex", "value": "~(?:]|<[^>]+[^a-zA-Z0-9_]on(?:cl|er|lo|fo|pu)\\\\w*\\\\s*=|[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]\\\\s*:)~i"}], "cve": "CVE-2026-42652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42652", "description": "User Registration <=5.1.5 reflected XSS via action parameter on payment history admin page", "mode": "block", "severity": 7.1, "slug": "user-registration", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=5.1.5"}, "RULE-CVE-2026-42665-01": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via order parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-02": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via orderby parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-03": {"ajax_action": "wpda_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via wpda_autocomplete AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42667-01": {"ajax_action": "bookly_speed_up_update_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42667", "description": "Bookly <=27.4 unauthenticated sensitive data exposure via bookly_speed_up_update_addons AJAX handler", "mode": "block", "severity": 7.5, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.4"}, "RULE-CVE-2026-42668-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/connect(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST connect endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/disconnect-current-site(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST disconnect endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/omnisend-settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST settings endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42678-01": {"ajax_action": "give_get_content_by_ajax", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]+onerror)~i"}], "cve": "CVE-2026-42678", "description": "GiveWP <=4.14.5 authenticated reflected XSS via url parameter in give_get_content_by_ajax AJAX handler", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.5"}, "RULE-CVE-2026-42684-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-03": {"ajax_action": "wpjobportal_ajax_popup_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup_action AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-04": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_loginwith_ajax social login handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42685-01": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS:wpjobportal-social/[a-z]+/", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-42685", "description": "WP Job Portal <=2.5.1 unauthenticated reflected XSS via social login parameters in wpjobportal_loginwith_ajax", "mode": "block", "severity": 7.1, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42687-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2026-42687", "description": "EventPrime <=4.3.2.1 unauthenticated PHP Object Injection via unserialize of raw request body in eventprime_api AJAX handler", "mode": "block", "severity": 8.1, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.2.1"}, "RULE-CVE-2026-42727-01": {"ajax_action": "woot_get_table_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_table_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-02": {"ajax_action": "woot_get_columns_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 subscriber+ blind SQL injection via table_html_id in woot_get_columns_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-03": {"ajax_action": "woot_get_smth", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_smth", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42734-01": {"ajax_action": "geo_mashup_kml_attachments", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_kml_attachments", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42734-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_query", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42742-01": {"ajax_action": "_review_action", "conditions": [{"name": "ARGS:view_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\\\\bIF\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\s+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42742", "description": "Views for WPForms Lite <=3.4.6 authenticated blind SQL injection via view_id in _review_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "views-for-wpforms-lite", "tags": ["sql-injection", "blind-sql", "missing-authorization"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-42756-01": {"ajax_action": "undo_single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in undo_single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-02": {"ajax_action": "single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-03": {"ajax_action": "image_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in image_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42775-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via orderby parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-42775-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via order parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-4283-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "super-unsubscribe"}, {"name": "ARGS:process_now", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4283", "description": "WP DSGVO Tools (GDPR) <=3.1.38 unauthenticated account destruction via super-unsubscribe process_now branch", "mode": "block", "severity": 9.1, "slug": "shapepress-dsgvo", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "account-destruction"], "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2026-4300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "rbs_gallery_options_loading"}, {"name": "ARGS:rsg_LoadingWord", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|body|iframe|object|embed|div|input|form|style|link|meta|audio|video|source|details|marquee)[\\\\s/>]|<[^>]+\\\\son[a-z]+\\\\s*=|javascript\\\\s*:|%3[Cc]\\\\s*(?:script|svg|img|body|iframe|div|input))~i"}], "cve": "CVE-2026-4300", "description": "Robo Gallery <=5.1.3 authenticated stored XSS via rsg_LoadingWord on rbs_gallery_options_loading settings page", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2026-4302-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optn/v1/integration-action(/|\\\\?|$)~"}, {"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:https?://)?(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|0[.]|0x|\\\\[[:0-9a-fA-F]|localhost))|(?:^(?:gopher|file|dict|ftp|telnet|ldap)://)~i"}], "cve": "CVE-2026-4302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4302", "description": "Optin (optin) <=1.4.29 unauthenticated SSRF via REST API optn/v1/integration-action link parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "optin", "tags": ["ssrf", "unauthenticated", "rest-api", "cwe-918"], "target": "plugin", "versions": "<=1.4.29"}, "RULE-CVE-2026-4303-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through post editor", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4303-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through REST API posts endpoint", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4306-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "getNextJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+=\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4306-02": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:task", "type": "equals", "value": "getNextTemplateJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:\\\\bUNION\\\\b\\\\s+(?:\\\\bALL\\\\b\\\\s+)?\\\\bSELECT\\\\b|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|/\\\\*[^*]*\\\\*+(?:[^/*][^*]*\\\\*+)*/|(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextTemplateJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4326-01": {"ajax_action": "afeb_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-4326", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4326", "description": "Vertex Addons for Elementor <=1.6.4 missing authorization on afeb_activate_required_plugins allows subscriber+ arbitrary plugin installation", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor-builder", "tags": ["missing-authorization", "arbitrary-plugin-installation", "privilege-escalation"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2026-4328-01": {"ajax_action": "demo_download_and_unzip", "conditions": [{"name": "ARGS:demo_file_type", "type": "equals", "value": "url"}, {"name": "ARGS:demo_file", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|ssh2?|telnet|tftp|expect|glob|phar|php|zip|rar|data|ogg|compress\\\\.zlib)\\\\s*:|(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.[0-9]|10\\\\.[0-9]|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?|0177\\\\.|0x7f)(?:[:/]|$))~i"}], "cve": "CVE-2026-4328", "description": "Advanced Import <=1.4.6 authenticated SSRF via demo_file parameter in demo_download_and_unzip AJAX handler", "mode": "block", "severity": 6.4, "slug": "advanced-import", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2026-4329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4329", "description": "Blackhole Bad Bots <=3.8 stored XSS via unescaped bot log data on admin settings page", "mode": "block", "severity": 7.2, "slug": "blackhole-bad-bots", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.8"}, "RULE-CVE-2026-4331-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "b2s_reset_social_meta_tags"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4331", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4331", "description": "Blog2Social <=8.8.2 missing authorization on b2s_reset_social_meta_tags allows subscriber+ deletion of all social meta data", "mode": "block", "severity": 4.3, "slug": "blog2social", "tags": ["missing-authorization", "data-deletion", "authenticated"], "target": "plugin", "versions": "<=8.8.2"}, "RULE-CVE-2026-4333-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4335", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4335", "description": "ShortPixel Image Optimizer <=6.4.3 Author+ stored XSS via attachment post_title rendered unescaped in AI editor popup", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2026-4336-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/ufaq(?:$|[/?]|\\\\?.*)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:script\\\\b[^>]*>.*?|[^>]+\\\\bon(?:click|load|error|mouseover|focus|blur)\\\\s*=|a\\\\b[^>]+\\\\bhref\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|img\\\\b[^>]+\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~is"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ content submitted to REST API /wp/v2/ufaq", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "ufaq"}, {"name": "ARGS:content", "type": "regex", "value": "~]|<[^>]+on(?:click|load|error|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<script|<[^&]*on(?:click|load|error|mouseover|focus|blur)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ post_content submitted through wp-admin/post.php editor", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4338-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitypub/1\\\\.0/outbox(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4338", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4338", "description": "ActivityPub <8.0.2 unauthenticated information disclosure of draft/scheduled/pending posts via site-level outbox REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "activitypub", "tags": ["information-disclosure", "rest-api", "unauthenticated", "improper-access-control"], "target": "plugin", "versions": "<8.0.2"}, "RULE-CVE-2026-4341-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:actions", "type": "regex", "value": "~follow_us_text[^}]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor AJAX save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~follow_us_text[^}]*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor REST save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4347-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via file upload move flow (generate_user_filepath / move_temp_file_to_upload_dir)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4347-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|phs|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via crafted uploaded filename in file field", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4365-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "delete_question_answer"}, {"type": "missing_capability", "value": "edit_lp_courses"}], "cve": "CVE-2026-4365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4365", "description": "LearnPress <=4.3.2.8 unauthenticated arbitrary quiz answer deletion via lp-ajax delete_question_answer", "method": "POST", "mode": "block", "severity": 9.1, "slug": "learnpress", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-4373-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-02": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in post.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4388-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in fm_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4388-02": {"action": "init", "conditions": [{"name": "ARGS:fm_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in non-AJAX form submission", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through REST API wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4484-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/masteriyo/v1/users/instructors/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:roles", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4484", "description": "Masteriyo LMS <=2.1.6 authenticated (Student+) privilege escalation to administrator via roles parameter in instructors REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2026-45218-01": {"action": "wp_ajax_nopriv_wp_travel_update_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_update_trip unauthenticated endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-02": {"action": "wp_ajax_nopriv_wp_travel_get_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_trip without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-03": {"action": "wp_ajax_wp_travel_get_pricings", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_pricings without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-04": {"action": "wp_ajax_nopriv_wptravel_save_user_enquiry", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wptravel_save_user_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-05": {"action": "wp_ajax_nopriv_wp_travel_add_to_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_add_to_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-06": {"action": "wp_ajax_nopriv_wp_travel_get_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-07": {"action": "wp_ajax_delete_itinerary_enquiry", "conditions": [{"name": "ARGS:enquiry_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via delete_itinerary_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45437-01": {"ajax_action": "eszlwcf_filter_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_filter_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45437-02": {"ajax_action": "eszlwcf_load_more_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_load_more_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45439-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:import)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API import endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-45439-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:update)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API update endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4655-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:options", "type": "regex", "value": "~bdt-svg-image~i"}, {"name": "ARGS:options", "type": "regex", "value": "~(?:%3C|<)\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*(?:=|%3D)|javascript\\\\s*(?::|%3A)|%253[Cc]script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4655", "description": "Element Pack Lite <=8.4.2 contributor+ stored XSS via SVG Image widget svg_source on elementor_ajax", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-4658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block class attributes (REST post save - className)", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4658-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~wp:essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|"javascript)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block markup in any request body", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4659-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]+){2,}|/etc/passwd|[/\\\\\\\\](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-4659", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4659", "description": "Unlimited Elements for Elementor <=2.0.6 authenticated contributor+ arbitrary file read via path traversal in Repeater JSON/CSV URL within Elementor widget settings", "mode": "block", "severity": 7.5, "slug": "unlimited-elements-for-elementor", "tags": ["path-traversal", "arbitrary-file-read", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2026-4664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ivole/v1/review(?:[/?&]|$)~"}, {"name": "ARGS:key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-4664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4664", "description": "Customer Reviews for WooCommerce <=5.103.0 unauthenticated authentication bypass on POST /ivole/v1/review via empty key parameter against ivole_secret_key meta", "method": "POST", "mode": "block", "severity": 5.3, "slug": "customer-reviews-woocommerce", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.103.0"}, "RULE-CVE-2026-4758-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4758-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax_popup", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4785-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (post.php save)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (heartbeat autosave)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (REST API)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4790-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:custom_svg", "type": "regex", "value": "~(?:]|\\\\son(?:load|error|click|mouseover|focus|animationstart|animationend)\\\\s*=|javascript\\\\s*:|]|]|])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4790", "description": "Premium Addons for Elementor <=4.11.70 contributor+ stored XSS via custom_svg parameter (CWE-79)", "mode": "block", "severity": 5.4, "slug": "premium-addons-for-elementor", "target": "plugin", "versions": "<=4.11.70"}, "RULE-CVE-2026-4801-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?(?:icalFeedUrl|eventsTitle|eventsDescription|eventsLocation)[\\\\s\\\\S]*?<[^>]+(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|])~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed attributes in Gutenberg REST API", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4801-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?icalFeedUrl[\\\\s\\\\S]*?(?:javascript\\\\s*:|<[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed URL attribute", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4812-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/post_object/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated post_object enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/relationship/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated relationship enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/page_link/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated page_link enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/user/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated user enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/select/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated select enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/taxonomy/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated taxonomy enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4817-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s+(?:UNION|SELECT|DROP|DELETE|INSERT|UPDATE|TABLE|INTO|VALUES|FROM|WHERE|version)\\\\s)~i"}], "cve": "CVE-2026-4817", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4817", "description": "MasterStudy LMS <=3.7.25 SQL injection via orderby parameter in stm-lms/order/items REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.25"}, "RULE-CVE-2026-4880-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "barcodeScannerConfigs"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX action (GET or POST)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-02": {"ajax_action": "setUserMeta", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via setUserMeta AJAX action (wp_capabilities)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]action=barcodeScannerConfigs(?:&|$)~"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX GET request (REQUEST_URI detection)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]barcode-scanner-lite-pos-to-manage-products-inventory-and-orders[/\\\\\\\\]request\\\\.php~"}, {"name": "ARGS:route", "type": "equals", "value": "setUserMeta"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via direct request.php setUserMeta endpoint (wp_capabilities)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-48835-01": {"ajax_action": "wpforms_connect_process", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48835", "description": "WPForms Lite <=1.10.0.4 unauthenticated broken access control via wpforms_connect_process AJAX handler", "mode": "block", "severity": 7.5, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.10.0.4"}, "RULE-CVE-2026-48874-01": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via orderby in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48874-02": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via order in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48882-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48882", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-48882", "description": "WP Time Slots Booking Form <=1.2.50 subscriber+ SQL injection via wpts_run_email_diagnostic AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-time-slots-booking-form", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.50"}, "RULE-CVE-2026-4896-01": {"ajax_action": "delete_wcfm_product", "conditions": [{"name": "ARGS:proid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_product allows authenticated users to delete arbitrary products without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-02": {"ajax_action": "delete_wcfm_article", "conditions": [{"name": "ARGS:articleid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_article allows authenticated users to delete arbitrary articles without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-03": {"ajax_action": "wcfm_modify_order_status", "conditions": [{"name": "ARGS:orderid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on wcfm_modify_order_status allows authenticated users to modify status of arbitrary orders without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-48964-01": {"ajax_action": "eh_crm_settings_initiate_ticket", "conditions": [{"name": "ARGS:start_number", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d+\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-48964", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.6 authenticated SQL injection via start_number in eh_crm_settings_initiate_ticket AJAX handler", "mode": "block", "severity": 8.5, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.6"}, "RULE-CVE-2026-48968-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_params in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_id in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via orderby in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via order in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-49044-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "acffa_settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-49044", "description": "Advanced Custom Fields: Font Awesome Field <=5.0.2 authenticated stored XSS via acffa_settings option values", "mode": "block", "severity": 6.5, "slug": "advanced-custom-fields-font-awesome", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-49055-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*\\\\bsrc\\\\s*=|]|])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated reflected XSS via path parameter in dnd_codedropz_upload_delete", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49055-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "FILES:upload-file:name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|]*\\\\bsrc\\\\s*=|]|])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated stored XSS via uploaded filename in dnd_codedropz_upload", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49063-01": {"ajax_action": "lsd_register", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_register (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-02": {"ajax_action": "lsd_login", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_login (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-03": {"ajax_action": "lsd_activation", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Authenticated Privilege Escalation via lsd_activation (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49067-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^yydev[_-]redirect~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-49067", "description": "Advanced 301 and 302 Redirect <=1.6.9 unauthenticated SQL injection via id parameter on admin page endpoint", "mode": "block", "severity": 9.3, "slug": "advanced-301-and-302-redirect", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-49069-01": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|=6.15.12 <=6.16.2 unauthenticated blind SQL injection via event_ids parameter on attendee registration page", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49772-02": {"ajax_action": "tec_qr_code_modal", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 authenticated blind SQL injection via post_id in tec_qr_code_modal AJAX handler", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49776-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|MAKE_SET|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-49776", "description": "GPTranslate <=2.32.6 unauthenticated SQL injection via id parameter in gptranslate/v1/request REST endpoint", "mode": "block", "severity": 9.3, "slug": "gptranslate", "target": "plugin", "versions": "<=2.32.6"}, "RULE-CVE-2026-49781-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/suretriggers/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49781", "description": "OttoKit (SureTriggers) <=1.1.27 unauthenticated PHP object injection via REST API", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2026-4987-01": {"ajax_action": "srfm_create_payment_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_payment_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4987-02": {"ajax_action": "srfm_create_subscription_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_subscription_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-5127-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpuf_submit_post"}, {"name": "ARGS:wpuf_files", "type": "regex", "value": "~(?:^|[^a-zA-Z0-9])(?:O|C|a):[0-9]+:(?:\\"|%22|%2522)~i"}], "cve": "CVE-2026-5127", "description": "WP User Frontend <=4.3.1 PHP object injection via wpuf_files parameter on admin-ajax.php action=wpuf_submit_post", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2026-5149-01": {"ajax_action": "get_submission_content", "conditions": [{"name": "ARGS:entries_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5149", "description": "RTMKit <=2.0.7 missing authorization on get_submission_content allows contributor+ to view arbitrary form submissions via entries_id IDOR", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-5162-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:elementor_data", "type": "regex", "value": "~instagram_follow_text[^}]{0,4000}?(?:<(?:\\\\\\\\?/?)?(?:script[\\\\s/>]|iframe|object|embed|applet|svg|img\\\\b)|on(?:error|load|click|mouseover|mouseout|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5162", "description": "Royal Elementor Addons <=1.7.1056 stored XSS via instagram_follow_text in Instagram Feed widget", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-5192-01": {"ajax_action": "forminator_submit_form_cform", "conditions": [{"name": "ARGS:upload-1[file][file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via upload-1[file][file_path] in form submit AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5192-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS:file_data[file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via file_data[file_path] in multiple file upload AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5200-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "acymailing_router"}, {"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5200", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5200", "description": "AcyMailing <=10.8.2 missing authorization on acymailing_router allows authenticated subscriber+ privilege escalation", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=10.8.2"}, "RULE-CVE-2026-5207-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (AJAX vector)", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5207-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "llms-reporting"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (admin page vector)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5229-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/form-notify/v1/callback(?:[/?]|$)~"}, {"name": "REQUEST_COOKIES:form_notify_line_email", "type": "exists"}], "cve": "CVE-2026-5229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5229", "description": "Form Notify <=1.1.10 unauthenticated authentication bypass via form_notify_line_email cookie on LINE OAuth callback", "mode": "block", "severity": 9.8, "slug": "form-notify", "tags": ["authentication-bypass", "improper-authentication", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2026-5231-01": {"action": "admin_init", "conditions": [{"name": "ARGS:tab", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+on[a-z]+=|]|]|]|])~i"}], "cve": "CVE-2026-5231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5231", "description": "WP Statistics <=14.16.4 reflected XSS via unsanitized tab parameter in admin template", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "reflected", "admin-template"], "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-52693-01": {"ajax_action": "get_viariation_details", "conditions": [{"name": "ARGS:cart_content[/\\\\d+/]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via cart_content in get_viariation_details AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52693-02": {"ajax_action": "shopping_cart_products", "conditions": [{"name": "ARGS:raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via raw parameter in shopping_cart_products AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52694-01": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:invitation", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~i"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive data exposure via document and invitation parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-02": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:download", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive document download via document and download parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-03": {"ajax_action": "esig_create_order_agreement", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 missing authorization on esig_create_order_agreement AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52697-01": {"ajax_action": "wppm_filter_autocomplete", "conditions": [{"name": "ARGS:project_search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_search in wppm_filter_autocomplete AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:project_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_id in wppm_get_project_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-03": {"ajax_action": "wppm_get_task_list", "conditions": [{"name": "ARGS:task_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via task_id in wppm_get_task_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-04": {"ajax_action": "wppm_edit_task_status", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via id parameter in wppm_edit_task_status AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-05": {"ajax_action": "wppm_get_task_list_card_view", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via page_no in wppm_get_task_list_card_view AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-06": {"ajax_action": "wppm_drag_and_drop_card", "conditions": [{"name": "ARGS:proj_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via proj_ids in wppm_drag_and_drop_card AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52702-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-redirection.php"}, {"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3Cscript|%3[Ee]|]+on[a-z]+=)~i"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 unauthenticated reflected XSS via redirect_from parameter on admin page", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52702-02": {"ajax_action": "customAddUpdate", "conditions": [{"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:\'|%27)\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 authenticated SQL injection via redirect_from in customAddUpdate AJAX handler", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/download(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/download REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/view-log(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/view-log REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/template/directory-tree(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via template/directory-tree REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5294-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5294", "description": "Geeky Bot <=1.2.2 unauthenticated arbitrary plugin installation via geekybot_frontendajax AJAX handler", "mode": "block", "severity": 9.8, "slug": "geeky-bot", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-5324-01": {"ajax_action": "brizy_form_submit", "conditions": [{"name": "ARGS:data[fields][FileUpload]", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5324", "description": "Brizy \\u2013 Page Builder <=2.8.11 unauthenticated stored XSS via form submission FileUpload field value", "mode": "block", "severity": 7.2, "slug": "brizy", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2026-5364-01": {"ajax_action": "cf7_file_uploads", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:^|\\\\|)\\\\s*(?:ph(?:p[2-9s]?|tml?|ar)|s?html?|cgi|aspx?|jspx?|cfm|htaccess|user\\\\.ini)\\\\s*(?:\\\\||$)~i"}], "cve": "CVE-2026-5364", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5364", "description": "Drag and Drop File Upload for Contact Form 7 <=1.1.3 unauthenticated arbitrary PHP file upload via extension validation bypass in cf7_file_uploads AJAX handler", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-file-upload-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "extension-bypass"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2026-5371-01": {"ajax_action": "monsterinsights_ads_get_token", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google OAuth access tokens via monsterinsights_ads_get_token AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "oauth-token-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-02": {"ajax_action": "monsterinsights_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized reset of Google Ads integration via monsterinsights_ads_reset_experience AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "integration-reset"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-03": {"ajax_action": "monsterinsights_ads_get_settings", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google Ads settings via monsterinsights_ads_get_settings AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "information-disclosure", "settings-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-54191-01": {"ajax_action": "pq_loadpod", "conditions": [{"name": "ARGS:pod", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]*on[a-z]+=|]|]|])~i"}], "cve": "CVE-2026-54191", "description": "Pods <=3.3.8 reflected XSS via pod parameter in pq_loadpod AJAX handler", "mode": "block", "severity": 7.1, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2026-54196-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS:_jf_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-54196", "description": "JetFormBuilder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation via Update User Action", "mode": "block", "severity": 6.8, "slug": "jetformbuilder", "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-5425-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/trustindex-feed-instagram/v1/webhook(?:[/?]|$)~"}, {"name": "ARGS:data[feed_data]", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5425", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5425", "description": "Social Photo Feed Widget <=1.7.9 unauthenticated stored XSS via REST webhook feed_data injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "social-photo-feed-widget", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.9"}, "RULE-CVE-2026-5427-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|templates|template-parts)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"kubio\\"[\\\\s\\\\S]{0,1000}?\\\\bhttps?://~i"}, {"name": "", "type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-5427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5427", "description": "Kubio AI Page Builder <=2.7.2 missing authorization on rest_pre_insert allows contributor-level arbitrary remote file import via kubio block attribute URL", "mode": "block", "severity": 5.3, "slug": "kubio", "tags": ["missing-authorization", "arbitrary-file-upload", "authenticated"], "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5465-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:call", "type": "regex", "value": "~users/providers/~i"}, {"name": "ARGS:externalId", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-5465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5465", "description": "Amelia Booking <=2.1.3 IDOR account takeover via externalId in provider profile update (wpamelia_api)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ameliabooking", "tags": ["idor", "account-takeover", "insecure-direct-object-reference", "authenticated"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-5478-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}(?:.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))?~i"}], "cve": "CVE-2026-5478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5478", "description": "Everest Forms <=3.4.4 unauthenticated arbitrary file read and deletion via path traversal in old_files parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "everest-forms", "tags": ["path-traversal", "local-file-inclusion", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.4.4"}, "RULE-CVE-2026-54802-01": {"ajax_action": "process_campaign", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54802", "description": "Block unauthenticated access to process_campaign AJAX action (CWE-862 Missing Authorization)", "mode": "block", "severity": 7.5, "slug": "sms-alert", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2026-54810-01": {"ajax_action": "build_payment_payload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on build_payment_payload AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-02": {"ajax_action": "apple_pay_validate_merchant", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on apple_pay_validate_merchant AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-03": {"ajax_action": "validate_checkout_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on validate_checkout_form AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-04": {"ajax_action": "get_build_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on get_build_fields AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54813-01": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-02": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-03": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-04": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54814-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 unauthenticated local file inclusion via template parameter in mvl_motors_starter_template AJAX handler", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54814-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 missing authorization on mvl_motors_starter_demo_install allows unauthenticated file write/delete", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "arbitrary-file-write", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54818-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:pageview_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|\\\\b(?:AND|OR)\\\\s+(?:\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54818", "description": "Slimstat Analytics <=5.4.11 authenticated (Subscriber+) blind SQL injection via pageview_id in slimstat_load_report AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<=5.4.11"}, "RULE-CVE-2026-54819-01": {"ajax_action": "lsd_accordion_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in accordion sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-02": {"ajax_action": "lsd_grid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in grid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-03": {"ajax_action": "lsd_list_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in list sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-04": {"ajax_action": "lsd_gallery_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in gallery sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-05": {"ajax_action": "lsd_halfmap_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in halfmap sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-06": {"ajax_action": "lsd_masonry_load_more", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in masonry load_more AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-07": {"ajax_action": "lsd_mosaic_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in mosaic sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-08": {"ajax_action": "lsd_listgrid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in listgrid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-09": {"ajax_action": "lsd_side_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in side sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-10": {"ajax_action": "lsd_table_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in table sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-11": {"ajax_action": "lsd_timeline_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in timeline sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54821-01": {"ajax_action": "vlp_get_template", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54821", "description": "Visual Link Preview <=2.3.1 subscriber+ sensitive data exposure via vlp_get_template AJAX handler missing capability check", "mode": "block", "severity": 7.4, "slug": "visual-link-preview", "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-54822-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/salesmanago/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54822", "description": "SALESmanago & Leadoo <=3.11.2 subscriber+ SQL injection via REST API endpoint", "mode": "block", "severity": 8.5, "slug": "salesmanago", "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-54825-01": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS:table_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54825", "description": "wpDataTables <=7.4 unauthenticated SQL injection via table_id in wdtable_update_cache AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpdatatables", "target": "plugin", "versions": "<=7.4"}, "RULE-CVE-2026-54828-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_template AJAX handler (LFI via include sink)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54828-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_demo_install AJAX handler (file_put_contents/unlink sinks)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54831-01": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_order in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-02": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:package_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via package_id in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-03": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_by in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54832-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-essence/v1/gutenverse-essence-proxy~"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-54832", "description": "Block unauthenticated access to gutenverse-essence REST proxy route (missing authorization \\u2013 permission_callback was __return_true in <=2.5.0)", "mode": "block", "severity": 7.5, "slug": "gutenverse-companion", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2026-54840-01": {"ajax_action": "newsletters_forms_createform", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_createform AJAX handler allows subscriber+ form creation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-02": {"ajax_action": "newsletters_forms_addfield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_addfield AJAX handler allows subscriber+ form field addition", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-03": {"ajax_action": "newsletters_forms_deletefield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_deletefield AJAX handler allows subscriber+ form field deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-04": {"ajax_action": "newsletters_admin_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_admin_mode AJAX handler allows subscriber+ admin mode toggle", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-05": {"ajax_action": "newsletters_change_themefolder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_change_themefolder AJAX handler allows subscriber+ theme folder change", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-06": {"ajax_action": "newsletters_delete_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_delete_option AJAX handler allows subscriber+ option deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-07": {"ajax_action": "newsletters_pause_queue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_pause_queue AJAX handler allows subscriber+ queue manipulation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/apbd-vtpos/v1/(?:current-user|get-logged-user|cashier-details|cash-drawer-info|cash-drawer-list|all-outlet-list|all-categories|all-taxes|heart-bit|list|details|end-of-day-data|categories|countries|attributes|getStock|close-cash-drawer|logout|email)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54841", "description": "VitePOS Lite <=3.4.2 unauthenticated sensitive data exposure via REST API endpoints missing permission callbacks", "mode": "block", "severity": 7.5, "slug": "vitepos-lite", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2026-54842-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/messages(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54842", "description": "Royal MCP <=1.4.25 missing authorization on royal-mcp/v1/messages REST endpoint allows subscriber+ access to privileged integration handlers", "mode": "block", "severity": 8.1, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.25"}, "RULE-CVE-2026-54844-01": {"ajax_action": "checkview_get_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview_get_status AJAX action (CWE-862: Missing Authorization). Patch removes both wp_ajax_nopriv_checkview_get_status and wp_ajax_checkview_get_status hooks entirely.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/checkview/v1/checkview-status(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview/v1/checkview-status REST route (CWE-862: Missing Authorization). Patch adds permission_callback with current_user_can(\'manage_options\') and nonce verification.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:wishlist_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via wishlist_id in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-ajax=premmerce_wishlist_popup~"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in WC AJAX wishlist popup handler", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-5488-01": {"ajax_action": "exactmetrics_ads_get_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_get_token allows subscriber+ role access to Google Ads OAuth token", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5488-02": {"ajax_action": "exactmetrics_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_reset_experience allows subscriber+ role to reset Google Ads experience", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5502-01": {"ajax_action": "tutor_update_course_content_order", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5502", "mode": "block", "severity": 5.3, "slug": "tutor", "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-56006-01": {"ajax_action": "h5p_embed", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56006", "description": "H5P <=1.17.6 unauthenticated reflected XSS via id parameter in h5p_embed AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.6"}, "RULE-CVE-2026-56011-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapp/v1/(?:maps|maps/(?:clone|import))(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=|]*on\\\\w+\\\\s*=|]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_params parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_id parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via orderby parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via order parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:post_mime_type", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via post_mime_type parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:detached", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via detached parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56028-01": {"ajax_action": "eel_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-56028", "description": "Easy Elements for Elementor <=1.4.9 unauthenticated privilege escalation via role parameter in eel_register AJAX handler", "mode": "block", "severity": 9.8, "slug": "easy-elements", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2026-56030-01": {"ajax_action": "pt_ajax_check_item_limits", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56030", "description": "Paytium <=5.0.2 unauthenticated privilege escalation via pt_ajax_check_item_limits", "mode": "block", "severity": 9.8, "slug": "paytium", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-56036-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via order_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:refund_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via refund_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:payment_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via payment_action parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:_pafw_uid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via _pafw_uid parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56040-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-form/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-56040", "description": "Gutenverse Form <=2.4.7 unauthenticated stored XSS via form submission REST API", "mode": "block", "severity": 7.1, "slug": "gutenverse-form", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-56042-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_mark_exported", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_mark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56042-02": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_unmark_exported", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_unmark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56043-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_submit_review AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56043-02": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_local_forms_submit AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56053-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:(?:\\\\\\"|\\\\{)~"}], "cve": "CVE-2026-56053", "description": "EventPrime <=4.3.4.1 subscriber+ PHP Object Injection via eventprime_api AJAX handler", "mode": "block", "severity": 8.8, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.4.1"}, "RULE-CVE-2026-56054-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:jsst_dir", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:\\\\b|[._])|error_log|debug\\\\.log))~i"}], "cve": "CVE-2026-56054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56054", "description": "JS Help Desk <=3.1.1 subscriber+ arbitrary file/directory deletion via jsticket_ajax AJAX handler (path traversal in jsst_dir)", "mode": "block", "severity": 7.7, "slug": "js-support-ticket", "tags": ["path-traversal", "arbitrary-file-deletion", "missing-authorization"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2026-56060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcdn/v1/(?:settings|dashboard|templates|fonts)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-56060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56060", "description": "Print Invoice & Delivery Notes for WooCommerce <=7.1.1 unauthenticated sensitive data exposure via REST API endpoints (wcdn/v1/settings, dashboard, templates, fonts)", "mode": "block", "severity": 7.5, "slug": "woocommerce-delivery-notes", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-56063-01": {"ajax_action": "mcbSubmit_Form_Data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 unauthenticated broken access control on mcbSubmit_Form_Data AJAX handler", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-02": {"ajax_action": "mcb_get_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcb_get_access_token allows subscriber+ OAuth token retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-03": {"ajax_action": "mcbAudienceList", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbAudienceList allows subscriber+ audience list retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-04": {"ajax_action": "mcbSubmit_Form_AudienceId", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbSubmit_Form_AudienceId allows subscriber+ audience ID modification", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56064-01": {"ajax_action": "tf_booking_calendar_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_calendar_filter AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-02": {"ajax_action": "tf_booking_details_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_details_popup AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-03": {"ajax_action": "tf_order_bulk_action_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_bulk_action_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-04": {"ajax_action": "tf_order_status_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_status_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-05": {"ajax_action": "tf_visitor_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_visitor_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-06": {"ajax_action": "tf_checkinout_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_checkinout_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56070-01": {"ajax_action": "thaps_ajax_get_search_value", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-56070", "description": "Unauthenticated SQL Injection via thaps_ajax_get_search_value AJAX handler in TH Advance Product Search <= 1.4.4", "mode": "block", "severity": 9.3, "slug": "th-advance-product-search", "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2026-56071-01": {"ajax_action": "forminator_submit_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via form submission field values", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-56071-02": {"ajax_action": "forminator_submit_preview_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via preview form submission", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-5710-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:[/?]|$)~"}, {"name": "ARGS:mfile", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2026-5710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5710", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.9.6 unauthenticated path traversal leading to arbitrary file read via mfile[] parameter on CF7 REST feedback endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.9.6"}, "RULE-CVE-2026-5714-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "enable-media-replace/enable-media-replace.php"}, {"name": "ARGS:location_dir", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]|]*on[a-z]+=|]|]|])~i"}], "cve": "CVE-2026-5714", "description": "Enable Media Replace <=4.1.8 authenticated (Author+) stored XSS via location_dir parameter", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "target": "plugin", "versions": "<=4.1.8"}, "RULE-CVE-2026-5722-01": {"ajax_action": "wlfmc_waitlist_signup", "conditions": [{"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist token reuse with email change", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-5722-02": {"action": "init", "conditions": [{"name": "ARGS:waitlist_verify", "type": "equals", "value": "1"}, {"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist verification link token reuse (blocks verification endpoint on vulnerable version; legitimate verification clicks also blocked until patched to 1.9.15)", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "verification-link", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-57317-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~simply-schedule-appointments/booking-app-new/iframe-inner\\\\.php~"}, {"name": "ARGS:token", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?![\\\\s])(?!(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-57317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57317", "description": "Simply Schedule Appointments <=1.6.12.2 unauthenticated reflected XSS via token parameter in booking iframe", "mode": "block", "severity": 7.1, "slug": "simply-schedule-appointments", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=1.6.12.2"}, "RULE-CVE-2026-57319-01": {"ajax_action": "woocs_convert_currency", "conditions": [{"name": "ARGS:precision", "type": "exists"}, {"name": "ARGS:precision", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'precision\' parameter in the woocs_convert_currency AJAX handler (wp_die sink at woocs.php:3728). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57319-02": {"ajax_action": "woocs_rates_current_currency", "conditions": [{"name": "ARGS:exclude", "type": "exists"}, {"name": "ARGS:exclude", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'exclude\' parameter in the woocs_rates_current_currency AJAX handler (wp_die sink at woocs.php:3754). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57321-01": {"ajax_action": "h5p_files", "conditions": [{"name": "ARGS:filePath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57321", "description": "H5P <=1.17.7 contributor+ arbitrary file deletion via path traversal in h5p_files AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.7"}, "RULE-CVE-2026-57631-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popup_category", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popup_category parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popupbox", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popupbox parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57636-01": {"ajax_action": "wpforo_ai_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57636", "description": "wpForo Forum <=3.0.9 contributor+ SQL injection via wpforo_ai_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "wpforo", "target": "plugin", "versions": "<=3.0.9"}, "RULE-CVE-2026-57644-01": {"ajax_action": "mprm_process_checkout", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57644-02": {"ajax_action": "mprm_process_checkout_login", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout_login AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57645-01": {"ajax_action": "newsletters_executemultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_executemultiple AJAX handler allows subscriber+ batch operations", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57645-02": {"ajax_action": "newsletters_exportmultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_exportmultiple AJAX handler allows subscriber+ data export", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57663-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via orderby parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57663-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via order parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57724-01": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "update-form-cell"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-57724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57724", "description": "Kirki <=6.0.12 authenticated PHP object injection via update-form-cell request writing to data field later unserialized without allowed_classes restriction", "mode": "block", "severity": 9.8, "slug": "kirki", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57728-01": {"action": "wp_footer", "conditions": [{"name": "ARGS:block", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-57728", "description": "Flatsome theme <=3.20.5 unauthenticated reflected XSS via block parameter in ux_block_frontend()", "mode": "block", "severity": 7.1, "slug": "flatsome", "target": "theme", "versions": "<=3.20.5"}, "RULE-CVE-2026-5809-01": {"ajax_action": "wpforo_ai_wp_get_post_types", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_get_post_types AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-02": {"ajax_action": "wpforo_ai_wp_get_taxonomies", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomies AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-03": {"ajax_action": "wpforo_ai_wp_get_taxonomy_terms", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomy_terms AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-04": {"ajax_action": "wpforo_ai_wp_index_by_taxonomy", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_index_by_taxonomy AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-05": {"ajax_action": "wpforo_ai_wp_index_custom", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_index_custom AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5957-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/emailkit/v1/create[_-]template(?:/|\\\\?|&|$)~"}, {"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 authenticated arbitrary file read via REST create_template emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-03": {"ajax_action": "emailkit_admin_action", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_admin_action AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-04": {"ajax_action": "emailkit_filter_save_as_template", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_filter_save_as_template AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-60137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-03": {"action": "init", "conditions": [{"name": "ARGS:/^author_exclude$|^author__not_in$/", "type": "detectSQLi"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress Core SQL injection via author__not_in / REST author_exclude in WP_Query (wp2shell SQLi primitive) - standalone/plugin-mediated parameter and WP 6.8.x coverage not addressed by the batch-scoped rules -01/-02.", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "unauthenticated", "wp-core", "wp2shell", "defense-in-depth"], "target": "core", "versions": ">=6.8.0 <6.8.6 || >=6.9.0 <6.9.5 || >=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-05": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6203-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "logout"}, {"name": "ARGS:redirect_to_on_logout", "type": "regex", "value": "~^\\\\s*(?:(?:https?:)?//|[a-zA-Z][a-zA-Z0-9+.-]*:)~i"}], "cve": "CVE-2026-6203", "description": "User Registration <=5.1.4 unauthenticated open redirect via redirect_to_on_logout parameter on wp-login.php logout", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-6227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/getblock(?:[/?&]|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:(?:(?:\\\\.\\\\.|%2e%2e)[\\\\\\\\/]|(?:\\\\.\\\\.|%2e%2e)(?:%2f|%5c)){2,}|(?:\\\\.{4,}[\\\\\\\\/]{1,}){2,}|%252e%252e(?:%252f|%255c|%2f|%5c|/|\\\\\\\\))~i"}], "cve": "CVE-2026-6227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6227", "description": "BackWPup <=5.6.6 authenticated local file inclusion via block_name parameter in /backwpup/v1/getblock REST endpoint", "mode": "block", "severity": 7.2, "slug": "backwpup", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.6"}, "RULE-CVE-2026-6229-01": {"action": "init", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via Data Table widget CSV URL parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6229-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via url parameter in Data Table CSV fetch", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6235-01": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apikey", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via manage_admin_requests", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6235-02": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apisecret", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via sm_apisecret", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (admin-post.php)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6248-02": {"action": "init", "conditions": [{"name": "ARGS:wpforo", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (front-end profile update)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6275-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|focus|input|blur)\\\\s*=|javascript\\\\s*:|\\"\\\\s*;)~i"}], "cve": "CVE-2026-6275", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6275", "description": "StatCounter <=2.1.1 Author+ stored XSS via nickname field echoed unescaped into JavaScript context by statcounter_addToTags()", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-63030-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-63030-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6320-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-6320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6320", "description": "Salon Booking System <=10.30.25 unauthenticated arbitrary file read via booking attachment file field path traversal", "mode": "block", "severity": 7.5, "slug": "salon-booking-system", "tags": ["arbitrary-file-read", "path-traversal", "unauthenticated", "file-inclusion"], "target": "plugin", "versions": "<=10.30.25"}, "RULE-CVE-2026-6372-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~^WC_Gateway_Plisio$~i"}, {"name": "ARGS:status", "type": "regex", "value": "~^(?:completed|mismatch|expired|cancelled)$~i"}], "cve": "CVE-2026-6372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6372", "description": "Accept Cryptocurrencies with Plisio <=2.0.5 unauthenticated payment bypass via forged wc-api callback", "mode": "block", "severity": 7.5, "slug": "plisio-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "payment-bypass", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-6403-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/v1/blueprint/[^/?]+(?:[/?]|$)~"}, {"name": "ARGS:stylesheet", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[a-z]:[/\\\\\\\\]|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-6403", "description": "Quick Playground <=1.3.3 unauthenticated path traversal via stylesheet parameter in blueprint REST endpoint", "mode": "block", "severity": 7.5, "slug": "quick-playground", "target": "plugin", "versions": "<=1.3.3"}, "RULE-CVE-2026-6456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/account-switcher/v1/remember-login(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6456", "description": "Account Switcher <=1.0.2 privilege escalation via rememberLogin REST endpoint loose comparison", "mode": "block", "severity": 8.8, "slug": "account-switcher", "tags": ["authentication-bypass", "privilege-escalation", "rest-api", "unauthenticated-from-subscriber"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-64638-01": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through the wp-login.php username or email field", "method": "POST", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-64638-02": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:X-HTTP-Method-Override", "type": "regex", "value": "~^(?:GET|PUT|PATCH|DELETE)$~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through wp-login.php with an HTTP method-override header", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-64638-03": {"action": "wp_authenticate", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:/[^?\\\\s]*)?(?:\\\\?|$)~i"}, {"name": "ARGS:/^_method$/", "type": "regex", "value": "~^(?:GET|PUT|PATCH|DELETE)$~i"}, {"name": "ARGS:/^log$/", "type": "regex", "value": "~<\\\\s+[a-z][a-z0-9:-]*(?:\\\\s|/?>)~i"}], "cve": "CVE-2026-64638", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf", "description": "WordPress core pre-auth reflected XSS through wp-login.php with a form method override", "mode": "block", "severity": 8.9, "tags": ["cross-site-scripting", "reflected-xss", "unauthenticated", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.34 || >=4.8.0 <4.8.29 || >=4.9.0 <4.9.30 || >=5.0.0 <5.0.26 || >=5.1.0 <5.1.23 || >=5.2.0 <5.2.25 || >=5.3.0 <5.3.22 || >=5.4.0 <5.4.20 || >=5.5.0 <5.5.19 || >=5.6.0 <5.6.18 || >=5.7.0 <5.7.16 || >=5.8.0 <5.8.14 || >=5.9.0 <5.9.14 || >=6.0.0 <6.0.13 || >=6.1.0 <6.1.11 || >=6.2.0 <6.2.10 || >=6.3.0 <6.3.9 || >=6.4.0 <6.4.9 || >=6.5.0 <6.5.9 || >=6.6.0 <6.6.6 || >=6.7.0 <6.7.6 || >=6.8.0 <6.8.7 || >=6.9.0 <6.9.6 || >=7.0.0 <7.0.3"}, "RULE-CVE-2026-6495-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_container_type", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_container_type", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_color", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_color", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_custom_js", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_custom_js", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_default_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_default_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-theme-templates~"}, {"name": "ARGS:alm_theme_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_theme_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-licenses~"}, {"name": "ARGS:alm_license_key", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_license_key", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_preview", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_preview", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6518-01": {"ajax_action": "cmp_theme_update_install", "conditions": [{"name": "ARGS:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6518", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6518", "description": "CMP Coming Soon & Maintenance <=4.1.16 authenticated arbitrary file upload via cmp_theme_update_install AJAX action", "mode": "block", "severity": 8.8, "slug": "cmp-coming-soon-maintenance", "tags": ["arbitrary-file-upload", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2026-65640-01": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~\\\\A(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core async-upload multipart field whose inspected bytes start with a plain PostScript resource header", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-02": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~\\\\A(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core REST multipart file field whose inspected bytes start with a plain PostScript resource header", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-03": {"action": "init", "conditions": [{"name": "FILES:async-upload:content", "type": "regex", "value": "~application/pdf.*(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core async-upload multipart field carrying visible PDF cover metadata followed by a plain PostScript signature in the inspected prefix", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "audio-cover", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-65640-04": {"action": "rest_api_init", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~application/pdf.*(?:%!|\\\\x04%!|\\\\xC5\\\\xD0\\\\xD3\\\\xC6|\\\\xFFWPC)~s"}], "cve": "CVE-2026-65640", "cve_link": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w", "description": "WordPress core REST multipart file field carrying visible PDF cover metadata followed by a plain PostScript signature in the inspected prefix", "mode": "block", "severity": 8.8, "tags": ["remote-code-execution", "malicious-file-upload", "postscript", "audio-cover", "multipart-partial-coverage", "wp-core"], "target": "core", "versions": ">=4.7.0 <4.7.35 || >=4.8.0 <4.8.30 || >=4.9.0 <4.9.31 || >=5.0.0 <5.0.27 || >=5.1.0 <5.1.24 || >=5.2.0 <5.2.26 || >=5.3.0 <5.3.23 || >=5.4.0 <5.4.21 || >=5.5.0 <5.5.20 || >=5.6.0 <5.6.19 || >=5.7.0 <5.7.17 || >=5.8.0 <5.8.15 || >=5.9.0 <5.9.16 || >=6.0.0 <6.0.14 || >=6.1.0 <6.1.12 || >=6.2.0 <6.2.11 || >=6.3.0 <6.3.10 || >=6.4.0 <6.4.10 || >=6.5.0 <6.5.10 || >=6.6.0 <6.6.7 || >=6.7.0 <6.7.7 || >=6.8.0 <6.8.8 || >=6.9.0 <6.9.7 || >=7.0.0 <7.0.4"}, "RULE-CVE-2026-6690-01": {"ajax_action": "lp_update_mds", "conditions": [{"name": "ARGS:n", "type": "regex", "value": "~(?:]|on[a-z]+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-6690", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6690", "description": "LifePress <=2.2.2 unauthenticated stored XSS via lp_update_mds AJAX action", "mode": "block", "severity": 7.2, "slug": "lifepress", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2026-6817-01": {"ajax_action": "ays_rate_the_quiz", "conditions": [{"name": "ARGS:rate_reason", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|pointermove|pointerenter|pointerleave|pointercancel|gotpointercapture|lostpointercapture|wheel|contextmenu|copy|cut|paste|drag|dragstart|dragend|dragenter|dragleave|dragover|drop|input|change|select|submit|reset|keydown|keyup|keypress|touchstart|touchend|touchmove|touchcancel|abort|beforeunload|hashchange|message|offline|online|pagehide|pageshow|popstate|resize|storage|unload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=|&#x?0*(?:3c|60)\\\\s*;\\\\s*script)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS via rate_reason parameter in ays_rate_the_quiz AJAX action", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6817-02": {"ajax_action": "ays_load_more_reviews", "conditions": [{"name": "ARGS:start_from", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS render path via ays_load_more_reviews start_from parameter", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6828-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+\\\\bonerror\\\\b|]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (post.php)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6828-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|]+\\\\bonerror\\\\b|]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6933-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "create_plugin"}, {"name": "ARGS:premmerce_plugin_namespace", "type": "regex", "value": "~[;{}()$`]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|eval|assert|phpinfo|file_put_contents|file_get_contents|base64_decode|unlink)\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 authenticated RCE via unsanitized namespace injection in plugin generator", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "generate_data"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on generate_data admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "clean_up"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on clean_up admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6963-01": {"ajax_action": "wmg_save_provider_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_save_provider_config allows subscriber+ privilege escalation", "mode": "block", "severity": 9.8, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-02": {"ajax_action": "wmg_get_saved_configs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_get_saved_configs allows subscriber+ data disclosure", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-03": {"ajax_action": "wmg_test_provider_config_send_mail", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_test_provider_config_send_mail allows subscriber+ email sending", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "email-abuse"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-7048-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post content", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7048-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post_content parameter", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7106-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:hscrm_user_roles", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-7106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7106", "description": "Highland Software Custom Role Manager <=1.0.0 authenticated privilege escalation via hscrm_user_roles[] on personal_options_update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "highland-software-custom-role-manager", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-7330-01": {"ajax_action": "aal_stats_save", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:]|on(?:error|load|click|mouseover|mouseout|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-7330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7330", "description": "WP Auto Affiliate Links <=6.8.8 unauthenticated stored XSS via url parameter", "mode": "block", "severity": 7.2, "slug": "wp-auto-affiliate-links", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=6.8.8"}, "RULE-CVE-2026-7465-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (classic editor)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-7465-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (REST API)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-7567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]temp-login-token\\\\[~"}], "cve": "CVE-2026-7567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7567", "description": "Temporary Login <=1.0.0 authentication bypass via non-scalar temp-login-token array parameter", "mode": "block", "severity": 9.8, "slug": "temporary-login", "tags": ["authentication-bypass", "unauthenticated", "cwe-288"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-7649-01": {"ajax_action": "arm_directory_paging_action", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:--|#)(?:\\\\s|$)|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\b.*\\\\bWHEN\\\\b|\\\\b(?:SLEEP|BENCHMARK)\\\\s*\\\\()~i"}], "cve": "CVE-2026-7649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7649", "description": "ARMember <=4.0.60 unauthenticated blind SQL injection via orderby parameter", "mode": "block", "severity": 8.8, "slug": "armember-membership", "tags": ["sql-injection", "unauthenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=4.0.60"}, "RULE-CVE-2026-7654-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\{?\\"~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via classic editor post meta (metavalue) leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-7654-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[a-zA-Z]~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via REST API post meta leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-7795-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through classic editor post.php", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-7795-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-8073-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8073-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/|(?:^|&|\\\\?)rest_route=/)[^?&]*(?:downloadZIP|download-zip|download_zip)~i"}, {"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter (rest_route query form)", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8089-01": {"ajax_action": "wemail_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wemail_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|animationstart)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|on[a-z]+=))~i"}], "cve": "CVE-2026-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8089", "description": "weMail <2.1.3 reflected XSS via shortcode parameter in wemail_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wemail", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-8096-01": {"ajax_action": "kirki_wp_admin_get_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_get_apis allows subscriber+ to read sensitive form submission data", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8096-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_post_apis allows subscriber+ to access admin-restricted POST API", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8163-01": {"ajax_action": "infility_redirect", "conditions": [{"name": "ARGS:RId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8163", "description": "Infility Global <2.15.19 authenticated (Subscriber+) SQL injection via RId parameter in infility_redirect AJAX handler", "mode": "block", "severity": 8.8, "slug": "infility-global", "target": "plugin", "versions": "<2.15.19"}, "RULE-CVE-2026-8172-01": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_name", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_name parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-02": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_email", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_email parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-03": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_message", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_message parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-04": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_subject", "type": "regex", "value": "~(?:]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_subject parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8379-01": {"action": "init", "conditions": [{"name": "ARGS:file_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-8379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8379", "description": "Frontend File Manager Plugin <=23.6 unauthenticated file download via IDOR on file_id parameter", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=23.6"}, "RULE-CVE-2026-8382-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_title", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post title overwrite via _post_title in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-8382-02": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_content", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post content overwrite via _post_content in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-8438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C(?:script|img|svg|iframe|object|embed|details|body|input|form|link|meta|style|marquee|video|audio|math|a(?:%20|\\\\+|%09|/|%2F))(?:%20|%09|%0[aAdD]|\\\\+|%3E|%2F|/)~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded HTML tags in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-8438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C[a-zA-Z][^%]*(?:%20|\\\\+|%09|/)on(?:error|load|click|mouseover|focus|blur|submit|change|input|animationend|toggle)%3D~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded event handler in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-8494-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-8494-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through REST API /wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-8719-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/tools(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP tool enumeration via REST API allows low-privilege users to list admin-level tools", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8719-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp-oauth(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP OAuth authorization allows non-admin users to authorize MCP applications", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8809-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_post_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~^administrator$~i"}], "cve": "CVE-2026-8809", "description": "ACF Extended <=0.9.2.5 unauthenticated privilege escalation via validation bypass in frontend form _acf_post_id parameter", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.5"}, "RULE-CVE-2026-8901-01": {"ajax_action": "integrazo_fwcrm_form_errorlog_show_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8901", "description": "Integration for Freshsales <=1.0.15 stored XSS via error log - missing capability check on errorlog_show_action allows subscriber+ to trigger stored XSS payloads", "mode": "block", "severity": 7.2, "slug": "crm-integration-freshworks-any-form", "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2026-8912-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS:form_input", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-8912", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via form_input parameter in post_cg_gallery_form_upload", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-900001-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-anything-on-click/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support / Essential Plugin supply chain attack: unauthenticated RCE via wpos-analytics REST endpoint. Compromised analytics.essentialplugin.com returns malicious serialized PHP object through unserialize() in class-anylc-admin.php, leading to arbitrary file_put_contents (dropper: wp-comments-posts.php, wp-config.php injection). Shared SDK affects 22 plugins (~200k installs). No CVE assigned \\u2014 synthetic ID.", "method": "POST", "mode": "block", "severity": 10.0, "slug": "popup-anything-on-click", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "ssrf", "backdoor", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-logo-showcase-responsive-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Logo Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-logo-showcase-responsive-slider-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/countdown-timer-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Countdown Timer Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "countdown-timer-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprps-post-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Responsive Recent Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-responsive-recent-post-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-news-and-scrolling-widgets/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP News and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-news-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-slick-slider-and-image-carousel/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Slick Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-slick-slider-and-image-carousel", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/album-and-image-gallery-plus-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Album and Image Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "album-and-image-gallery-plus-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-testimonials-with-rotator-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Testimonial with Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-testimonial-with-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-09": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-blog-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Blog and Widgets plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-blog-and-widgets", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-10": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/blog-designer-post-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Blog Designer for Post and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "blog-designer-for-post-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-11": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/meta-slider-and-carousel-with-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Meta Slider and Carousel plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "meta-slider-and-carousel-with-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-12": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid-and-filter-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Post Grid and Filter Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "post-grid-and-filter-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-13": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timeline-and-history-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Timeline and History Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "timeline-and-history-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-14": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-responsive-faq-with-category-plugin/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP FAQ plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-faq", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-15": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-team-showcase-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Team Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-team-showcase-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-17": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-trending-post-slider-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Trending Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-trending-post-slider-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-18": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-post-creative/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Featured Post Creative plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "featured-post-creative", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-19": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/portfolio-and-projects/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Portfolio and Projects plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "portfolio-and-projects", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-20": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ticker-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Ticker Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "ticker-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-21": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video-gallery-and-player/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in HTML5 Video Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "html5-videogallery-plus-player", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-22": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-featured-content-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Featured Content and Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-featured-content-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-9109-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~]|on(?:error|load|toggle|mouseover|focus|click|change)\\\\s*=|javascript\\\\s*:|]|]|]+\\\\bon[a-z]~i"}], "cve": "CVE-2026-9109", "description": "GPTranslate <=2.31 unauthenticated stored XSS via REST API translation storage", "mode": "block", "severity": 7.2, "slug": "gptranslate", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2026-9125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9125-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9134-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through post editor", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9134-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through REST API", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9178-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v3/user/list/[0-9]+(?:/|\\\\?|$)~"}, {"name": "REQUEST_HEADERS:Username", "type": "exists"}], "cve": "CVE-2026-9178", "description": "WP Forms Connector <=1.8 unauthenticated sensitive user data exposure via wp/v3/user/list REST endpoint", "mode": "block", "severity": 7.5, "slug": "wp-forms-connector", "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-9243-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~carousel_direction[^}]*(?:on(?:focus|blur|mouse(?:over|enter|move|out)|click|dblclick|key(?:down|up|press)|load|error|focusin|focusout|pointerover|touchstart|animationend)\\\\s*=|style\\\\s*=\\\\s*[^\\"]*(?:position|expression))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9243", "description": "The Plus Addons for Elementor <=6.4.15 contributor+ stored XSS via carousel_direction unquoted attribute injection", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.4.15"}, "RULE-CVE-2026-9570-01": {"action": "init", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~[\'\\"><();]|=1.0.0"}, "TEST-RULE": {"action": "init", "conditions": [{"name": "ARGS:test-rule", "type": "equals", "value": "b3d45e60-53a5-4959-b911-5178baaef7ac"}], "cve": "TEST-CVE", "mode": "block", "severity": 2.0, "target": "core", "versions": ">=1.0.0"}}}', true );