Atomicorp WAF Research Notes

Research Update - 2026-07-22

Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.

The entries published in this update represent research notes produced during ongoing analysis activities.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

Presence means a positive research finding was published. Absence means no conclusion should be drawn.

CVE Notes Published in This Update

CVEVulnerability NameRules Observed
CVE-2019-16932Visualizer <3.3.1 - Blind Server-Side Request Forgery344362
CVE-2024-22476Intel Neural Compressor <2.5.0 - SQL Injection341245
CVE-2025-45854JEHC-BPM - Remote Code Execute344363 , 390724
CVE-2025-59528Flowise - Remote Code Execution345240 , 380026
CVE-2026-48907Joomla! JCE extension < 2.9.99.5 unauthenticated RCE333360 , 383871
CVE-2026-8054dotCMS Core Publish Audit API - Unauthenticated SQL Injection340145 , 340156 , 344366
CVE-2023-6825WordPress File Manager <= 7.2.1 - Directory Traversal377360
CVE-2024-51482ZoneMinder v1.37.* <= 1.37.64 - SQL Injection340016 , 341245 , 380026 , 380122
CVE-2017-14097Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control330791 , 340007 , 340152
CVE-2019-12989Citrix SD-WAN and NetScaler SD-WAN - SQL Injection340016 , 340017 , 340157 , 340159 , 341245 , 360147 , 360148
CVE-2019-16072Enigma NMS < 65.0.0 - Authenticated OS Command Injection344364
CVE-2019-20504Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution340014 , 340029 , 344363
CVE-2019-7139Magento - SQL Injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026
CVE-2020-10257ThemeREX Addons - Remote Code Execution377360
CVE-2020-10987Tenda AC15 AC1900 version 15.03.05.19 - Command Injection340014 , 344364 , 344366 , 344370
CVE-2020-13942Apache Unomi <1.5.2 - Remote Code Execution340095
CVE-2020-25223Sophos UTM Preauth - Remote Code Execution340014 , 344364 , 344366
CVE-2020-27615WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via log Parameter340156 , 341245 , 380026 , 380122
CVE-2020-28429geojson2kml - Command Injection344361 , 344363
CVE-2020-35131Cockpit CMS 0.6.1 - Remote Code Execution340095
CVE-2020-7980Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution344360
CVE-2020-9480Apache Spark - Authentication Bypass340162 , 340163
CVE-2021-22005VMware vCenter Server - Arbitrary File Upload330791 , 340152
CVE-2021-22175GitLab CI Lint API - Server-Side Request Forgery344362 , 344370
CVE-2021-22502Micro Focus Operations Bridge Reporter - Remote Code Execution344364 , 344366
CVE-2021-24849WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection340016 , 340017 , 360147 , 360148 , 380122
CVE-2021-25281SaltStack Salt <3002.5 - Auth Bypass340007
CVE-2021-28799QNAP HBS 3 - Broken Access Control344360 , 390904
CVE-2021-3018IPeakCMS 3.5 - SQL Injection380122
CVE-2021-3129Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution340007 , 340077 , 340162 , 344365 , 398007
CVE-2021-31316CentOS Web Panel - SQL Injection340016 , 340017 , 341245
CVE-2021-31324CentOS Web Panel - OS Command Injection340016 , 340017 , 341245
CVE-2021-45467Control Web Panel (CWP) - File Inclusion320464 , 320465 , 390613 , 390614
CVE-2022-0479Popup Builder Plugin - SQL Injection and Cross-Site Scripting340016 , 340017 , 340144 , 340157 , 377360
CVE-2022-0948WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection380026 , 380122
CVE-2022-24112Apache APISIX - Remote Code Execution344364 , 344366 , 344370
CVE-2022-24627AudioCodes Device Manager Express - SQL Injection340145 , 340156 , 390572
CVE-2022-28033Atom.CMS 2.0 - SQL Injection380026 , 380122
CVE-2022-28219Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution344370
CVE-2022-30525Zyxel Firewall - OS Command Injection344363
CVE-2022-3481NotificationX Dropshipping < 4.4 - SQL Injection340016 , 380026 , 380122
CVE-2022-45699APsystems ECU-R Firmware - Command Injection344364 , 344366
CVE-2022-47986IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution344364 , 344370
CVE-2023-0600WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection341245 , 380026 , 380122
CVE-2023-1454Jeecg-boot 3.5.0 qurestSql - SQL Injection340157 , 340159 , 360147 , 360148
CVE-2023-25280D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection340014 , 344364 , 344366
CVE-2023-27034Jms Blog - SQL Injection380122
CVE-2023-27638tshirtecommerce PrestaShop Module - SQL Injection341245 , 380026 , 380122
CVE-2023-27847PrestaShop xipblog - SQL Injection340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122
CVE-2023-30150PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection341245 , 380026 , 380122
CVE-2023-30192PrestaShop 'possearchproducts' <= 1.7 - SQL Injection341245 , 380026 , 380122
CVE-2023-30194Prestashop posstaticfooter <= 1.0.0 - SQL Injection341245 , 344366
CVE-2023-3077MStore API < 3.9.8 - SQL Injection341245 , 380026 , 380122
CVE-2023-30869Easy Digital Downloads - Privilege Escalation377360
CVE-2023-3197WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection340016 , 380026 , 380122
CVE-2023-3380WAVLINK WN579X3 - Remote Command Execution340014 , 344363
CVE-2023-3452WordPress Canto Plugin <= 3.0.4 - File Inclusion340077 , 340694 , 340695
CVE-2023-34659JeecgBoot 3.5.0 - SQL Injection330791 , 340152
CVE-2023-34990FortiWLM - Directory Traversal340007
CVE-2023-39650PrestaShop Theme Volty CMS Blog - SQL Injection340016 , 340156 , 341145 , 341245 , 380026 , 380122
CVE-2023-40504LG Simple Editor <= v3.21.0 - Command Injection340007 , 344362
CVE-2023-43373Hoteldruid v3.0.5 - SQL Injection340016 , 341245 , 380026 , 380122
CVE-2023-43374Hoteldruid v3.0.5 - SQL Injection340016 , 341245 , 380026 , 380122
CVE-2023-45852Viessmann Vitogate 300 - Remote Code Execution344360 , 344361 , 344363
CVE-2023-6360WordPress My Calendar <3.4.22 - SQL Injection340016 , 340156 , 341145 , 341245 , 380026 , 380122
CVE-2023-6655Hongjing e-HR 2020 - SQL Injection341245 , 344366 , 361149
CVE-2023-7116WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection340014 , 344364 , 344366
CVE-2024-0195SpiderFlow Crawler Platform - Remote Code Execution337209 , 337210 , 337211 , 340095
CVE-2024-12209WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion344360 , 347009 , 390709
CVE-2024-1698NotificationX <= 2.8.2 - SQL Injection341245 , 380026 , 380122
CVE-2024-22729Netis MW5360 V1.0.1.3031 - Command Injection392301
CVE-2024-31848CData API Server < 23.4.8844 - Path Traversal344365
CVE-2024-31849CData Connect < 23.4.8846 - Path Traversal344365
CVE-2024-3552Web Directory Free < 1.7.0 - SQL Injection340156 , 380122
CVE-2024-38773FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection340016 , 340017 , 360147 , 360148 , 380122
CVE-2024-3922Dokan Pro <= 3.10.3 - SQL Injection392301
CVE-2024-399071Panel SQL Injection - Authenticated344370 , 380026
CVE-2024-44000LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure390716
CVE-2024-45622ASIS - SQL Injection Authentication Bypass340145 , 340156 , 341145
CVE-2024-4620ArForms < 6.6 - Remote Code Execution382238
CVE-2024-48307JeecgBoot v3.7.1 - SQL Injection340157 , 340159 , 341245 , 360147 , 360148
CVE-2024-50498WP Query Console <= 1.0 - Remote Code Execution340095
CVE-2024-5057WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection380122
CVE-2024-5765WpStickyBar <= 2.1.0 - SQL Injection380122
CVE-2024-5827Vanna - SQL injection340029 , 344360 , 344370 , 347009
CVE-2024-6159Push Notification for Post and BuddyPress <= 1.93 - SQL Injection380122
CVE-2024-6460WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion336461 , 340748 , 344360 , 347006 , 381206
CVE-2024-6670WhatsUp Gold HasErrors SQL Injection - Authentication Bypass340016 , 341245 , 344362
CVE-2024-6671WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass340016 , 340159 , 344362 , 344366
CVE-2024-6924TrueBooker <= 1.0.2 - SQL Injection341245 , 380122
CVE-2024-6926Viral Signup <= 2.1 - SQL Injection380122
CVE-2024-6928Opti Marketing <= 2.0.9 - SQL Injection380122
CVE-2024-7854Woo Inquiry <= 0.1 - SQL Injection380122
CVE-2024-8911LatePoint <= 5.0.11 - SQL Injection380122
CVE-2024-9234GutenKit <= 2.1.0 - Arbitrary File Upload340162 , 340163
CVE-2025-13486Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution377360
CVE-2025-3248Langflow AI - Unauthenticated Remote Code Execution340095 , 344360 , 344370
CVE-2025-40552SolarWinds Web Help Desk - Authentication Bypass392301
CVE-2025-6058WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload382238
CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution340156 , 344370
CVE-2026-8037Progress ADC LoadMaster - Command Injection340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-9082Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query340156 , 341245
CVE-2023-1892Sidekiq < 7.0.8 - Cross-Site Scripting333141 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148
CVE-2024-9264Grafana Post-Auth DuckDB - SQL Injection To File Read340016 , 344360 , 344370
CVE-2026-28496FOSSBilling - Server-Side Template Injection340130 , 340155 , 341155
CVE-2026-46442Flowise < 3.1.2 - node-custom-function Unauthorized RCE345240
CVE-2020-37123Pinger 1.0 - Remote Code Execution344363
CVE-2024-32128WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection340016 , 341245 , 380026 , 380122
CVE-2025-32778Web-Check < 2.0.1 Screenshot API - OS Command Injection344363 , 393655
CVE-2026-27174MajorDoMo - Unauthenticated RCE344360 , 344370 , 347009 , 390904
CVE-2026-29014MetInfo CMS <= 8.1 - Remote Code Execution340121 , 344363 , 360152 , 380026 , 390635 , 393655
CVE-2026-54836YMC Filter - SQL Injection341245 , 380026 , 380122
CVE-2026-27760OpenCATS - Command Injection344363 , 344370
CVE-2026-41179RClone RC - Command Injection340014 , 344370
CVE-2019-9880WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure344361 , 344363
CVE-2021-37425Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)330791 , 340152
CVE-2022-44727PrestaShop lgcookieslaw - SQL Injection340016 , 341245 , 380026 , 380122
CVE-2024-3673Web Directory Free < 1.7.3 - Local File Inclusion340748 , 344360 , 390709
CVE-2024-40422Devika v1 - Path Traversal340007 , 344360 , 347009 , 390709
CVE-2024-5975CZ Loan Management <= 1.1 - SQL Injection380122
CVE-2026-40887Vendure Core - SQL Injection340156 , 340157 , 341245 , 344361 , 344363 , 360147 , 360148
CVE-2026-54157LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery392301
CVE-2020-11978Apache Airflow <=1.10.10 - Remote Code Execution344364
CVE-2020-2036Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting347198
CVE-2023-32749Pydio Cells 4.1.2 - Unauthorised Role Assignments330791 , 340152
CVE-2023-45375PrestaShop PireosPay - SQL Injection341245 , 344366
CVE-2023-49230Peplink Balance Two before 8.4.0 - Unauthenticated Config Upload330791 , 340152 , 392301
CVE-2023-50094reNgine 2.2.0 - Command Injection330791 , 340152
CVE-2024-30464WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization377360
CVE-2024-41667OpenAM<=15.0.3 FreeMarker - Template Injection344360 , 392647 , 393655
CVE-2024-8252WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion344360
CVE-2025-32614EventON Lite <= 2.4 - Authenticated Local File Inclusion344360 , 377360 , 390709
CVE-2022-41800F5 BIG-IP Appliance Mode - Command Injection344362 , 344363
CVE-2024-6911PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion344365 , 347019
CVE-2026-35029LiteLLM - Arbitrary File Read344360 , 390709
CVE-2021-22214Gitlab CE/EE 10.5 - Server-Side Request Forgery344362
CVE-2024-13726Themes Coder Ecommerce <= 1.3.4 - SQL Injection341245 , 380026 , 380122
CVE-2024-31850CData Arc < 23.4.8839 - Path Traversal344365
CVE-2024-31851CData Sync < 23.4.8843 - Path Traversal344365
CVE-2024-34470HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion340007 , 344360 , 347009 , 390709
CVE-2024-9186Automation By Autonami < 3.3.0 - SQL Injection340016 , 340017 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122
CVE-2025-2558WordPress The Wound Theme <= 0.0.1 - Local File Inclusion336461 , 340007 , 344360 , 347009 , 381206 , 390709
CVE-2026-3326XStore Theme < 9.7.3 - SQL Injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-34885WordPress Media Library Assistant <= 3.34 - SQL Injection377360
CVE-2024-35219OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete340007
CVE-2024-40348Bazarr < 1.4.3 - Arbitrary File Read347009
CVE-2025-49002DataEase - Remote Code Execution340195
CVE-2026-23482Blinko < 1.8.4 - Path Traversal347009
CVE-2021-25094Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution382238
CVE-2025-52970Fortinet FortiWeb - Authentication Bypass to Admin Privilege340157 , 360147 , 360148
CVE-2026-11111chrome Security Vulnerability340016 , 340162
CVE-2025-46822Java-springboot-codebase 1.1 - Arbitrary File Read347009
CVE-2025-59341esm.sh <= v136 - Local File Inclusion347009
CVE-2025-47783Label Studio < 1.18.0 - Reflected XSS340147 , 340148 , 342259 , 344370 , 346755
CVE-2019-14206Nevma Adaptive Images - Arbitrary File Deletion340007 , 377360
CVE-2020-22165PHPGurukul Hospital Management System 4.0 - SQL Injection340016 , 340017 , 340145 , 340157 , 340159 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2020-5766SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection340016 , 340017 , 340144 , 360147 , 360148 , 380122 , 380123
CVE-2020-9483SkyWalking SQLI341250
CVE-2021-40822Geoserver - Server-Side Request Forgery340007
CVE-2023-2356Mlflow <2.3.0 - Local File Inclusion340007
CVE-2023-32590Subscribe to Category <= 2.7.4 - SQL Injection340016 , 340156 , 341145 , 341245 , 380026 , 380122
CVE-2023-34105SRS - Command Injection344364
CVE-2023-36284QloApps 1.6.0 - SQL Injection341245 , 380026 , 380122
CVE-2024-0705Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection340016 , 380122
CVE-2024-12849Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read344360 , 390709
CVE-2024-1483Mlflow < 2.9.2 - Path Traversal340007 , 340162 , 340163 , 390709
CVE-2024-1561Gradio 4.3-4.12 - Local File Read344365
CVE-2024-1728Gradio > 4.19.1 UploadButton - Path Traversal344360
CVE-2024-2879WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection340016 , 380122
CVE-2024-2928MLflow < 2.11.3 - Path Traversal340007 , 340162 , 340163 , 390709
CVE-2024-36420Flowise 1.4.3 - Arbitrary File Read344360 , 390709
CVE-2024-36991Splunk Enterprise - Local File Inclusion390716
CVE-2024-3848Mlflow < 2.11.0 - Path Traversal340007 , 340162 , 340163 , 390709
CVE-2024-41628Cluster Control CMON API - Directory Traversal347009
CVE-2024-46938Sitecore Experience Platform <= 10.4 - Arbitrary File Read340007 , 344360 , 344365 , 347019 , 390709
CVE-2024-6049Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal390716
CVE-2024-6587LiteLLM - Server-Side Request Forgery340162 , 340163
CVE-2024-8484REST API TO MiniProgram <= 4.7.1 - SQL Injection380026 , 380122
CVE-2024-8529LearnPress < 4.2.7.1 - SQL Injection341245 , 380026 , 380122
CVE-2024-9935PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download340007 , 344360 , 347009 , 390709
CVE-2025-13801Yoco Payments <= 3.8.8 - Path Traversal340007 , 344360 , 347009 , 390709
CVE-2025-27817Apache Kafka Client - Arbitrary File Read344360
CVE-2025-30208Vite - Arbitrary File Read347009 , 390709
CVE-2025-69411ionCube Tester Plus <= 1.3 - Local File Inclusion340007 , 344360 , 347009 , 390709
CVE-2026-0560LolLMS < 2.2.0 - Server-Side Request Forgery360151
CVE-2026-2416Geo Mashup <= 1.13.17 - SQL Injection380122
CVE-2026-28414Gradio - Absolute Path Traversal390716
CVE-2026-3018WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 380026 , 380122
CVE-2026-3396WCAPF WooCommerce Ajax Product Filter - SQL Injection340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122
CVE-2024-36683PrestaShop productsalert - SQL Injection340016 , 340156 , 380026 , 380122
CVE-2024-46507Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE340130 , 360151
CVE-2025-14340Payara Server - Cross-Site Scripting341266 , 346755
CVE-2024-13624WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting341266 , 377360
CVE-2024-9474PAN-OS Management Web Interface - Command Injection344363
CVE-2025-62613VDO.Ninja - DOM-Based Cross-Site Scripting333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350148
CVE-2018-7691Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure (2)330791 , 340152
CVE-2020-13945Apache APISIX - Insufficiently Protected Credentials344363 , 380026
CVE-2021-22145Elasticsearch 7.10.0-7.13.3 - Information Disclosure330791 , 340152
CVE-2021-36749Apache Druid - Local File Inclusion340029 , 344360
CVE-2023-27167Suprema BioStar 2 v2.8.16 - SQL Injection330791 , 340152 , 341145 , 380026 , 380122
CVE-2024-24565CrateDB Database - Arbitrary File Read340016 , 340017 , 340029 , 344360 , 344370
CVE-2024-4257BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection341245 , 344366 , 361149
CVE-2024-32231Stash < 0.26.0 - SQL Injection340016 , 340017 , 340157 , 340159 , 344361 , 344362 , 344363 , 344366 , 360147 , 360148
CVE-2026-29066TinaCMS - Path Traversal347009 , 390709
CVE-2014-4535Import Legacy Media <= 0.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2014-4536Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2014-4539Movies <= 0.6 - Cross-Site Scripting333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2014-4550Shortcode Ninja <= 1.4 - Cross-Site Scripting340147 , 341266
CVE-2014-4558WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 344370 , 346755 , 350147 , 350148
CVE-2014-4561Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2015-9414WordPress Symposium <=15.8.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000126WordPress Admin Font Editor <=1.8 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000127WordPress AJAX Random Post <=2.00 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000128WordPress anti-plagiarism <=3.60 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000129WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000130WordPress e-search <=1.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000131WordPress e-search <=1.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2016-1000132WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000133WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000134WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000135WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000136WordPress heat-trackr 1.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000137WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000138WordPress Admin Font Editor <=1.8 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000139WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting340147 , 341256 , 341266 , 342259
CVE-2016-1000140WordPress New Year Firework <=1.1.9 - Cross-Site Scripting340147 , 341266
CVE-2016-1000141WordPress Page Layout builder v1.9.3 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2016-1000142WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000143WordPress Photoxhibit 2.1.8 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000146WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting322100 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000148WordPress S3 Video <=0.983 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2016-1000149WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2016-1000152WordPress Tidio-form <=1.0 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2016-1000153WordPress Tidio Gallery <=1.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000154WordPress WHIZZ <=1.0.7 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2016-1000155WordPress WPSOLR <=8.6 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2017-11107phpLDAPadmin <= 1.2.3 - Reflected XSS340147 , 341256 , 341266 , 342259 , 350148
CVE-2017-17043WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2017-17059WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148 , 392301
CVE-2017-17451WordPress Mailster <=1.5.4 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 390585
CVE-2017-18590Timesheet Plugin < 0.1.5 - Cross-Site Scripting341266 , 346755 , 377360
CVE-2017-18598WordPress Qards - Cross-Site Scripting393749
CVE-2017-9288WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2018-10383Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting333141 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2018-20462WordPress JSmol2WP <=1.07 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2019-12935Shopware < 5.5.8 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2019-14470WordPress UserPro 4.9.32 - Cross-Site Scripting333141 , 347198
CVE-2019-15713WordPress My Calendar <= 3.1.9 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2019-15889WordPress Download Manager <2.9.94 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585
CVE-2019-16332WordPress API Bearer Auth <20190907 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2019-16525WordPress Checklist <1.1.9 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2019-16931WordPress Visualizer <3.3.1 - Cross-Site Scripting340147 , 340148 , 341256 , 342259 , 346755 , 350148
CVE-2019-9912WP Google Maps < 7.10.43 - Cross-Site Scripting340099 , 341099 , 346755 , 347198
CVE-2020-26153Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting340147 , 341266 , 342259
CVE-2020-28351Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting341266
CVE-2020-29395Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting333141 , 342259 , 347198 , 350148
CVE-2020-36510WordPress 15Zine <3.3.0 - Cross-Site Scripting341266 , 346755
CVE-2020-7107WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting333140 , 333141 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148
CVE-2021-20323Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting333141 , 341258
CVE-2021-24214WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2021-24274WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting341266 , 346755
CVE-2021-24298WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2021-24320WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2021-24335WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2021-24342WordPress JNews Theme <8.0.6 - Cross-Site Scripting340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2021-24364WordPress Jannah Theme <5.4.4 - Cross-Site Scripting341266 , 346755
CVE-2021-24407WordPress Jannah Theme <5.4.5 - Cross-Site Scripting392301
CVE-2021-24522ProfilePress < 3.1.11 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2021-27695openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting330791 , 333141 , 340147 , 340148 , 340149 , 340152 , 341256 , 342259 , 346755
CVE-2021-36646KodExplorer - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2021-41467JustWriting - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2022-0381WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting346755 , 350148
CVE-2022-1724WordPress Simple Membership <4.1.1 - Cross-Site Scripting341266 , 346755
CVE-2022-2383WordPress Feed Them Social <3.0.1 - Cross-Site Scripting346755 , 347198
CVE-2022-31470Axigen WebMail - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148
CVE-2023-1893Login Configurator <=2.1 - Cross-Site Scripting341266 , 346755
CVE-2023-2518WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting347198 , 377360
CVE-2023-38040Revive Adserver 5.4.1 - Cross-Site Scripting340147 , 341256 , 341266 , 346755
CVE-2023-3990Mingsoft MCMS < 5.3.1 - Cross-Site Scripting342259 , 350148
CVE-2023-40755PHPJabbers Callback Widget v1.0 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2023-4151Store Locator WordPress < 1.4.13 - Cross-Site Scripting377360
CVE-2023-41597EyouCms v1.6.2 - Cross-Site Scripting340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2023-4284WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting346755 , 347198 , 377360
CVE-2023-44812mooSocial v.3.1.8 - Cross-Site Scripting340147 , 340148 , 341266 , 342259 , 346755
CVE-2023-5558LearnPress < 4.2.5.5 - Cross-Site Scripting340147 , 340148 , 342259 , 346755 , 390722 , 392301
CVE-2024-13853WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2024-29931WP Go Maps <= 9.0.29 - Cross-Site Scripting341266 , 344370 , 346755 , 377360
CVE-2024-3032WordPress Themify Builder < 7.5.8 - Open Redirect377360
CVE-2024-41810Twisted - Open Redirect & XSS340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2024-47374LiteSpeed Cache <= 6.5.0.2 - Stored XSS377360
CVE-2024-6651WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting341266 , 346755 , 377360
CVE-2024-7354Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting341266 , 346755 , 377360
CVE-2025-25296Label Studio < 1.16.0 - Cross-Site Scripting333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344370 , 346755 , 347198
CVE-2025-54597Heimdall Application Dashboard < 2.7.3 - Reflected XSS333141 , 340099 , 340147 , 341099 , 342259 , 347198 , 350147 , 350148
CVE-2026-15094WP Hotel Booking <= 2.3.2 - Cross-Site Scripting300002
CVE-2024-3753Hostel < 1.1.5.3 - Cross-Site Scripting341266 , 346755 , 377360
CVE-2025-28906Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting346755 , 377360
CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query340156 , 344370
CVE-2024-6095LocalAI - Partial Local File Read344360
CVE-2025-47423Personal Weather Station Dashboard 12 - Directory Traversal340007
CVE-2025-59342esm.sh <= v136 - Arbitrary File Write via Path Traversal340162 , 340163
CVE-2016-10993ScoreMe Theme - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2020-11110Grafana <= 6.7.1 - Cross-Site Scripting346755 , 350148
CVE-2023-1315osTicket < v1.16.6 - Cross-Site Scripting341266 , 346755
CVE-2023-1318osTicket < v1.16.6 - Cross-Site Scripting341266 , 346755
CVE-2023-2745WordPress Core <=6.2 - Directory Traversal336461 , 340007 , 344360 , 381206
CVE-2023-6030LogDash Activity Log <= 1.1.3 - SQL Injection340016 , 341245 , 380026 , 380122
CVE-2024-21485Dash Framework - Cross-site Scripting346755 , 350148
CVE-2021-4191GitLab GraphQL API User Enumeration344361 , 344363
CVE-2022-25497Cuppa CMS v1.0 - Local File Inclusion340007 , 344360 , 390709
CVE-2024-8852All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure390716
CVE-2025-11368LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure344365
CVE-2025-2710Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-50230Lyrion Music Server <= 9.2.0 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390716
CVE-2014-4577WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion344360 , 347009 , 390709
CVE-2014-4941Cross RSS 1.7 - Local File Inclusion344360 , 347009 , 390709
CVE-2014-5181Last.fm Rotation 1.0 - Path Traversal344360 , 347009 , 390709
CVE-2014-5187Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal340007 , 344360 , 347009 , 390709
CVE-2006-1681Cherokee HTTPD <=0.5 - Cross-Site Scripting341266
CVE-2008-1061WordPress Sniplets <=1.2.2 - Cross-Site Scripting340147 , 341266
CVE-2011-4624GRAND FlAGallery 1.57 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2011-4926Adminimize 1.7.22 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2011-5107Alert Before Your Post <= 0.1.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2011-5179Skysa App Bar 1.04 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2011-5181ClickDesk Live Support Live Chat 2.0 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2011-5265Featurific For WordPress 1.6.2 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2012-0901YouSayToo auto-publishing 1.0 - Cross-Site Scripting340147 , 341266 , 342259
CVE-2012-1835WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2012-2371WP-FaceThumb 0.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2012-4242WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2012-42732 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2012-4768WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2012-5913WordPress Integrator 1.32 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2013-2287WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2013-3526WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148
CVE-2013-4117WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2013-4625WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2014-4513ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755
CVE-2014-9094WordPress DZS-VideoGallery Plugin Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585
CVE-2015-2807Navis DocumentCloud <0.1.1 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 348476 , 350147 , 350148
CVE-2015-4127WordPress Church Admin <0.810 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2015-6920WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 348476 , 350147 , 350148
CVE-2026-55592Dashy <= 4.3.6 - Reflected XSS via Workspace340112 , 346755 , 350148
CVE-2024-4841LoLLMS WebUI - Subfolder Prediction via Path Traversal344365